# Logstash processing the same file again and again from a remote shared path

**URL:** <https://discuss.elastic.co/t/logstash-processing-the-same-file-again-and-again-from-a-remote-shared-path/96955>\
**Category:** Logstash\
**Created:** [August 14, 2017, 11:11am UTC](https://discuss.elastic.co/t/logstash-processing-the-same-file-again-and-again-from-a-remote-shared-path/96955 "2017-08-14T11:11:10Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![anisen](https://avatars.discourse-cdn.com/v4/letter/a/5fc32e/32.png) [@anisen](https://discuss.elastic.co/u/anisen)\
**Post date:** [August 14, 2017, 11:11am UTC](https://discuss.elastic.co/t/logstash-processing-the-same-file-again-and-again-from-a-remote-shared-path/96955/1 "2017-08-14T11:11:10Z")

</div>

Hi,

I have a logfile in a shared path (//XXXX/storage/files/test.log) with 100 lines.

I am processing the it with logstash with the below input cong:  
input {  
file {  
path =\> "//XXXX/storage/files/test.log"  
start\_position =\> "beginning"  
}  
}

But, logstash is processing the same 100 lines of the file again and again.  
I want it to stop after it processes the file once.

Please suggest.

---

<div class="post-metadata">

**Author:** ![CDR](https://avatars.discourse-cdn.com/v4/letter/c/d9b06d/32.png) [@CDR](https://discuss.elastic.co/u/CDR)\
**Post date:** [August 14, 2017, 12:07pm UTC](https://discuss.elastic.co/t/logstash-processing-the-same-file-again-and-again-from-a-remote-shared-path/96955/2 "2017-08-14T12:07:00Z")

</div>

You might want to take a look at the since\_db setting, which you can read about [here](https://www.elastic.co/guide/en/logstash/current/plugins-inputs-file.html#plugins-inputs-file-sincedb_path)

---

<div class="post-metadata">

**Author:** ![anisen](https://avatars.discourse-cdn.com/v4/letter/a/5fc32e/32.png) [@anisen](https://discuss.elastic.co/u/anisen)\
**Post date:** [August 14, 2017, 12:49pm UTC](https://discuss.elastic.co/t/logstash-processing-the-same-file-again-and-again-from-a-remote-shared-path/96955/3 "2017-08-14T12:49:42Z")

</div>

Hi @CDR , tried with different options, but no success. Could you please suggest which since\_db option need to be used.

---

<div class="post-metadata">

**Author:** ![CDR](https://avatars.discourse-cdn.com/v4/letter/c/d9b06d/32.png) [@CDR](https://discuss.elastic.co/u/CDR)\
**Post date:** [August 14, 2017, 12:52pm UTC](https://discuss.elastic.co/t/logstash-processing-the-same-file-again-and-again-from-a-remote-shared-path/96955/4 "2017-08-14T12:52:40Z")

</div>

sincedb\_path is what I would suggest. Point it to a location and it will create a text file that keeps track of the location of the location in the file it has read.

---

<div class="post-metadata">

**Author:** ![anisen](https://avatars.discourse-cdn.com/v4/letter/a/5fc32e/32.png) [@anisen](https://discuss.elastic.co/u/anisen)\
**Post date:** [August 14, 2017, 1:17pm UTC](https://discuss.elastic.co/t/logstash-processing-the-same-file-again-and-again-from-a-remote-shared-path/96955/5 "2017-08-14T13:17:29Z")

</div>

Hi @CDR, I added this:

input {  
file {  
path =\> "//XXXX/storage/files/test.log"  
start\_position =\> “beginning”  
**sincedb\_path =\> "D:/sincedb/test.txt"**  
}  
}

But, still same issue. Logstash keeps on reading and processing the same 100 lines from the file though it is not modified.

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [August 14, 2017, 1:55pm UTC](https://discuss.elastic.co/t/logstash-processing-the-same-file-again-and-again-from-a-remote-shared-path/96955/6 "2017-08-14T13:55:30Z")

</div>

Reading files from a shared path is known to have the potential to result in issues, as outlined in the [documentation](https://www.elastic.co/guide/en/logstash/current/plugins-inputs-file.html#_reading_from_remote_network_volumes).

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 11, 2017, 1:55pm UTC](https://discuss.elastic.co/t/logstash-processing-the-same-file-again-and-again-from-a-remote-shared-path/96955/7 "2017-09-11T13:55:34Z")

</div>

Closed on September 11, 2017, 1:55pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.