# Logstash service restart : reading file from beginning

**URL:** <https://discuss.elastic.co/t/logstash-service-restart-reading-file-from-beginning/58974>\
**Category:** Logstash\
**Created:** [August 25, 2016, 6:41pm UTC](https://discuss.elastic.co/t/logstash-service-restart-reading-file-from-beginning/58974 "2016-08-25T18:41:09Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![anoopmk007](https://avatars.discourse-cdn.com/v4/letter/a/45deac/32.png) [@anoopmk007](https://discuss.elastic.co/u/anoopmk007)\
**Post date:** [August 25, 2016, 6:41pm UTC](https://discuss.elastic.co/t/logstash-service-restart-reading-file-from-beginning/58974/1 "2016-08-25T18:41:09Z")

</div>

Hello,

I am facing some issues with logstash service restart.  
Every time when restart the service , then logstash start reading logs files from beginning.

Any idea how to resolve this?

logstash configuration:-

input {  
file{  
path =\> "E:/DashBoard/OUTBOUND/\*"  
start\_position =\> "end"  
}  
}

filter  
{  
kv {  
source =\> "message"  
value\_split =\> "]"  
field\_split =\> ","  
trimkey =\> "["  
}

mutate  
{  
add\_field =\>["[geoip][location]","%{[latitude]}"]  
add\_field =\>["[geoip][location]","%{[longitude]}"]  
}

mutate  
{  
convert =\>["[geoip][location]","float"]

}  
}

output {  
elasticsearch { hosts =\> ["xx.xx.xx.xx:9200"] }  
stdout { codec =\> rubydebug }  
}

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [August 25, 2016, 8:23pm UTC](https://discuss.elastic.co/t/logstash-service-restart-reading-file-from-beginning/58974/2 "2016-08-25T20:23:34Z")

</div>

I'm guessing Logstash is having issues writing the sincedb file (or reading it upon startup). Look in your logs for clues about sincedb. You may have to crank up the logging by starting Logstash with `-v` or even `-d`.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:41am UTC](https://discuss.elastic.co/t/logstash-service-restart-reading-file-from-beginning/58974/3 "2017-07-06T04:41:32Z")

</div>