# Logstash read file in what order?

**URL:** https://discuss.elastic.co/t/logstash-read-file-in-what-order/274549
**Category:** Logstash
**Created:** [May 31, 2021, 9:19pm UTC](https://discuss.elastic.co/t/logstash-read-file-in-what-order/274549 "2021-05-31T21:19:35Z")
**Posts on this page:** 1
**Showing post:** 18

<div class="post-metadata">

### Author: ![theirfan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/theirfan/32/89339_2.png) [@theirfan](https://discuss.elastic.co/u/theirfan)
#### Post date: [June 3, 2021, 2:08am UTC](https://discuss.elastic.co/t/logstash-read-file-in-what-order/274549/18 "2021-06-03T02:08:52Z")

</div>

> [@Logstash/grok to match only first occurrence and stop parsing repeatedly for same values](https://discuss.elastic.co/t/logstash-grok-to-match-only-first-occurrence-and-stop-parsing-repeatedly-for-same-values/274201/10):
>
> What I would do is grok { pattern\_definitions =\> { "CUSTOMTIME" =\> "%{DAY} %{MONTH} %{MONTHDAY} %{TIME}" } match =\> { "message" =\> "%{CUSTOMTIME:[@metadata][timestamp]} %{GREEDYDATA:[@metadata][restOfLine]}" } } date { match =\> ["[@metadata][timestamp]", "EEE MMM dd HH:mm:ss" ] } ruby { init =\> '@lastValue = nil' code =\> ' now = event.get("@timestamp").to\_f if @lastValue == nil @lastTime = now e…

based on your earlier solution for getting time durations of each value, can we add another parameter to also check the change of path or filename too?

Like, this code of yours is checking of change of value and subtracting timestamps to get durations. If this code can also check change of path, and parse new file as separate file.

Let me know about it?

---

_[View the full topic](https://discuss.elastic.co/t/logstash-read-file-in-what-order/274549)._