# Maybe I missed something: FIlebeat prospectors seems to randomly stop harvesting 'some' files

**URL:** https://discuss.elastic.co/t/maybe-i-missed-something-filebeat-prospectors-seems-to-randomly-stop-harvesting-some-files/37499
**Category:** Beats
**Tags:** filebeat
**Created:** [December 17, 2015, 7:32pm UTC](https://discuss.elastic.co/t/maybe-i-missed-something-filebeat-prospectors-seems-to-randomly-stop-harvesting-some-files/37499 "2015-12-17T19:32:03Z")
**Posts on this page:** 1
**Showing post:** 4

<div class="post-metadata">

### Author: ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)
#### Post date: [December 18, 2015, 4:48pm UTC](https://discuss.elastic.co/t/maybe-i-missed-something-filebeat-prospectors-seems-to-randomly-stop-harvesting-some-files/37499/4 "2015-12-18T16:48:08Z")

</div>

From [this comment](https://discuss.elastic.co/t/filebeat-do-not-see-file-updates-after-a-while/34914/23) it seems ignore\_older should be bigger the maximum update period, so files are not closed too soon and still picked up.

Can you try to run filebeat with -e -d 'prospector' to log some debug message (and other logs) to stderr?

After closing a file due to ignore\_older prospector might generate different debug messages for this file:

```
- (always if last now - mod_time > ignore_older) Fetching old state of file to resume
    - Resuming harvester on a previously harvested file
    - Skipping file ...
- (if now - mod_time < ignore_older and file renamed) File rename was detected
- (if now - mod_time < ignore_older and no file rename)
    - (if file is already known) Resuming harvester on a previously harvested file
    - (if new file) Launching harvester on new file

```

The timestamps on your log-file match the actual log event timestamp. Filebeat uses the file modification time. If you know a file its name being affected in advance you can try this line of bash to get unique mod-time updates at about every second:

```
$ logfile=...; while true; do sleep 1; ls -l --full-time $logfile; done | uniq
```

---

_[View the full topic](https://discuss.elastic.co/t/maybe-i-missed-something-filebeat-prospectors-seems-to-randomly-stop-harvesting-some-files/37499)._