# Logstash will read 3days old file
**URL:** https://discuss.elastic.co/t/logstash-will-read-3days-old-file/95950
**Category:** Logstash
**Created:** [August 4, 2017, 8:01pm UTC](https://discuss.elastic.co/t/logstash-will-read-3days-old-file/95950 "2017-08-04T20:01:45Z")
**Posts on this page:** 8
**Page:** 1
### Author:  [@P\_Kumar](https://discuss.elastic.co/u/P_Kumar)
#### Post date: [August 4, 2017, 8:01pm UTC](https://discuss.elastic.co/t/logstash-will-read-3days-old-file/95950/1 "2017-08-04T20:01:45Z")
Is it possible to logstash5 will read 3 days old SystemOut.log file ?
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [August 5, 2017, 3:34pm UTC](https://discuss.elastic.co/t/logstash-will-read-3days-old-file/95950/2 "2017-08-05T15:34:26Z")
If configured to do so Logstash will read files with any name and any age.
---
### Author:  [@P\_Kumar](https://discuss.elastic.co/u/P_Kumar)
#### Post date: [August 5, 2017, 5:25pm UTC](https://discuss.elastic.co/t/logstash-will-read-3days-old-file/95950/3 "2017-08-05T17:25:12Z")
I configure 5 files in one logstash configration but it is sending only 3 files to elastic serch and rest are not sending but it is showing in stdout .so i thought it may be file age.how we will debug this issue and who is blocking rest 2 files to send elstic search
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [August 5, 2017, 5:47pm UTC](https://discuss.elastic.co/t/logstash-will-read-3days-old-file/95950/4 "2017-08-05T17:47:34Z")
Show us your configuration.
---
### Author:  [@P\_Kumar](https://discuss.elastic.co/u/P_Kumar)
#### Post date: [August 7, 2017, 8:38pm UTC](https://discuss.elastic.co/t/logstash-will-read-3days-old-file/95950/5 "2017-08-07T20:38:05Z")
input {
file {
type =\> "nodeagent"
path =\> ["/opt/WebSphere/AppServer/profiles/AppSrv01/logs/nodeagent/SystemOut.log"]
ignore\_older =\> "400000000"
start\_position =\> "beginning"
sincedb\_path =\> "/dev/null"
```
}
file {
type => "websphere1"
path => ["/opt/WebSphere/AppServer/profiles/AppSrv01/logs/App-v01/SystemOut.log"]
ignore_older => 4
start_position => "beginning"
sincedb_path => "/dev/null"
}
file {
type => "app1"
path => ["/opt/WebSphere/AppServer/profiles/AppSrv01/logs/App1-v01/SystemOut.log"]
ignore_older => 4
start_position => "beginning"
sincedb_path => "/dev/null"
}
file {
type => "app"
path => ["/opt/WebSphere/AppServer/profiles/AppSrv01/logs/App12Server1/SystemOut.log"]
ignore_older => 4
start_position => "beginning"
sincedb_path => "/dev/null"
}
file{
type => "dmgr"
path => ["/opt/WebSphere/AppServer/profiles/Dmgr01/logs/dmgr/SystemOut.log"]
start_position => "beginning"
ignore_older => 4
sincedb_path => "/dev/null"
}
```
}
#filter {
# grok {
# match =\> ["message", "%{COMBINEDAPACHELOG}"]
# }
#}
output {
if [type] == "nodeagent" {
elasticsearch{
hosts =\> ["x.x.x.x:9200"]
index =\> "x.x.x.x\_nodeAgent\_%{+YYYY.MM.dd}"
}
}
if [type] == "websphere1" {
elasticsearch{
hosts =\> ["x.x.x.x:9200"]
index =\> "x.x.x.x\_App-v01\_%{+YYYY.MM.dd}"
}
}
if [type] == "app1" {
elasticsearch{
hosts =\> ["x.x.x.x:9200"]
index =\> "x.x.x.x\_App1-v01\_%{+YYYY.MM.dd}"
}
}
if [type] == "app" {
elasticsearch{
hosts =\> ["x.x.x.x:9200"]
index =\> "x.x.x.x\_App12Server1-v01\_%{+YYYY.MM.dd}"
}
}
if [type] == "dmgr" {
elasticsearch{
hosts =\> ["x.x.x.x:9200"]
index =\> "x.x.x.x\_dmgr\_%{+YYYY.MM.dd}"
}
}
else {
stdout{
codec =\> rubydebug
}
}
}
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [August 8, 2017, 5:22am UTC](https://discuss.elastic.co/t/logstash-will-read-3days-old-file/95950/6 "2017-08-08T05:22:18Z")
If you look in your Logstash logs I'm pretty sure you'll find lots of log entries telling you that it can't create the indexes because index names must be all lowercase.
---
### Author:  [@P\_Kumar](https://discuss.elastic.co/u/P_Kumar)
#### Post date: [August 8, 2017, 6:54pm UTC](https://discuss.elastic.co/t/logstash-will-read-3days-old-file/95950/7 "2017-08-08T18:54:58Z")
Thanks it is working now.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 5, 2017, 6:55pm UTC](https://discuss.elastic.co/t/logstash-will-read-3days-old-file/95950/8 "2017-09-05T18:55:30Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.