# Logstash Watch Folder for files changes

**URL:** https://discuss.elastic.co/t/logstash-watch-folder-for-files-changes/81770
**Category:** Logstash
**Created:** [April 10, 2017, 8:20am UTC](https://discuss.elastic.co/t/logstash-watch-folder-for-files-changes/81770 "2017-04-10T08:20:46Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![kab](https://avatars.discourse-cdn.com/v4/letter/k/9dc877/32.png) [@kab](https://discuss.elastic.co/u/kab)
#### Post date: [April 10, 2017, 8:20am UTC](https://discuss.elastic.co/t/logstash-watch-folder-for-files-changes/81770/1 "2017-04-10T08:20:46Z")

</div>

Hi,

Logstash v1.5.4

With this release version of logstash , any ideas of best way to scan folder to see if any files exists  
and push the file names to elastic search ?

the selection pattern should be based on the creation date of the file.

rule :  
push file to index if and only if (current\_date - file\_create\_date) \> threshold.

Thanks .

---

<div class="post-metadata">

### Author: ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [April 10, 2017, 9:09am UTC](https://discuss.elastic.co/t/logstash-watch-folder-for-files-changes/81770/2 "2017-04-10T09:09:49Z")

</div>

The file input does not take that into account because it does not read anything other than the inode number.  
You may be able to do some funky ruby to test, if the filename had a date in it.

Also, upgrade! 1.5 is super old!

---

<div class="post-metadata">

### Author: ![kab](https://avatars.discourse-cdn.com/v4/letter/k/9dc877/32.png) [@kab](https://discuss.elastic.co/u/kab)
#### Post date: [April 10, 2017, 9:14am UTC](https://discuss.elastic.co/t/logstash-watch-folder-for-files-changes/81770/3 "2017-04-10T09:14:38Z")

</div>

Hi, ok thanks for your suggestions !

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 8, 2017, 9:21am UTC](https://discuss.elastic.co/t/logstash-watch-folder-for-files-changes/81770/4 "2017-05-08T09:21:49Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
