# Logstash Sending older logs
**URL:** https://discuss.elastic.co/t/logstash-sending-older-logs/365019
**Category:** Logstash
**Created:** [August 16, 2024, 11:16am UTC](https://discuss.elastic.co/t/logstash-sending-older-logs/365019 "2024-08-16T11:16:44Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@devops\_training](https://discuss.elastic.co/u/devops_training)
#### Post date: [August 16, 2024, 11:16am UTC](https://discuss.elastic.co/t/logstash-sending-older-logs/365019/1 "2024-08-16T11:16:44Z")
Logstash is sending older messages. Below is my pipeline.
```auto
input {
file {
path => "C:/Program Files (x86)/dataops/ag/web/Logs/webSvr*"
type => "webSvr"
start_position => "beginning"
}
file {
path => "C:/Program Files (x86)/dataops/webserver/Server/logs/webserver.log"
type => "webserver.log"
start_position => "beginning"
}
file {
path => "C:/Program Files (x86)/dataops/webserver/Server/logs/app.log"
type => "app"
codec => multiline {
pattern => "^%{TIMESTAMP_ISO8601}"
negate => true
what => "previous"
charset => "ISO-8859-1"
}
start_position => "beginning"
}
}
filter {
if [type] == "webSvr" {
grok {
match => {"message" => "^%{INT:logtimestamp}%{GREEDYDATA:message}"}
overwrite => ["message"]
}
mutate {
remove_field => ["logtimeStamp"]
}
}
if [type] == "webserver.log" {
grok {
match => {"message" => "\[%{HTTPDATE:logtimeStamp}\] %{IP:hostip} %{URIPROTO:method} %{URIPATH:post-data} (?:%{NOTSPACE:queryparam}|-) %{NUMBER:useragent} %{NUMBER:responsestatus} \[%{GREEDYDATA:message}\] - %{NUMBER:time-taken:int}"}
overwrite => ["message"]
}
mutate {
remove_field => ["logtimeStamp"]
}
}
if [type] == "app" {
mutate {
gsub => [
"message", "\[\] ", " ",
"message", "\- ", " ",
"message", "\s+", " "
]
}
mutate {
strip => ["message"]
}
grok {
match => {"message" => ["%{TIMESTAMP_ISO8601:logtimeStamp} %{WORD:loglevel} \[%{USERNAME:httpcall}] %{USERNAME:dbName} %{USERNAME:tenant} %{INT:tenantId} %{INT:userId} %{USERNAME:session} %{GREEDYDATA:message}",
"%{TIMESTAMP_ISO8601:logtimeStamp} %{WORD:loglevel} %{GREEDYDATA:message}" ]}
overwrite => ["message"]
}
mutate {
remove_field => ["logtimeStamp"]
}
}
}
filter {
fingerprint {
method => "SHA1"
key => "103013"
}
}
output {
if [type] == "web" {
elasticsearch {
ecs_compatibility => disabled
hosts => " *************************** :443"
ssl => true
index => "${NODE_ROLE}-traffic-%{+YYYY.MM.dd}"
}
}
else {
elasticsearch {
ecs_compatibility => disabled
hosts => " ***************** :443"
ssl => true
index => "${NODE_ROLE}-%{+YYYY.MM.dd}"
}
}
}
```
please suggest.
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [August 16, 2024, 3:59pm UTC](https://discuss.elastic.co/t/logstash-sending-older-logs/365019/2 "2024-08-16T15:59:02Z")
> [@devops\_training](#):
>
> Logstash is sending older messages.
What makes you think that is an issue?
---
### Author:  [@devops\_training](https://discuss.elastic.co/u/devops_training)
#### Post date: [August 16, 2024, 6:30pm UTC](https://discuss.elastic.co/t/logstash-sending-older-logs/365019/3 "2024-08-16T18:30:43Z")
In log file new events are present.
In elk I see August 13 messages instead on August 16th isn’t this issue?
---
### Author:  [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)
#### Post date: [August 16, 2024, 8:33pm UTC](https://discuss.elastic.co/t/logstash-sending-older-logs/365019/4 "2024-08-16T20:33:34Z")
> [@devops\_training](#):
>
> In elk I see August 13 messages instead on August 16th isn’t this issue?
No, the default behavior of the `file` input when you configure it to read a path is to read every file in that directory.
You can however use the `ignore_older` [option](https://www.elastic.co/guide/en/logstash/current/plugins-inputs-file.html#plugins-inputs-file-ignore_older) to configure it to ignore files that have a modified date older than some specific time in seconds.
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [August 16, 2024, 10:02pm UTC](https://discuss.elastic.co/t/logstash-sending-older-logs/365019/5 "2024-08-16T22:02:12Z")
Also, you set `start_position => "beginning"`, so if a log file covers multiple days you have asked for all the old data to be included. Perhaps `start_position => "end"` would work better for you.
---
### Author:  [@devops\_training](https://discuss.elastic.co/u/devops_training)
#### Post date: [August 19, 2024, 2:44pm UTC](https://discuss.elastic.co/t/logstash-sending-older-logs/365019/6 "2024-08-19T14:44:27Z")
thank you @Badger and @leandrojmp. Just a thought after looking at the documentation. In case if I have a fingerprint filter. Will this sort the issue.