# Need inode or file timestamp in the event

**URL:** <https://discuss.elastic.co/t/need-inode-or-file-timestamp-in-the-event/157711>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [November 21, 2018, 1:19pm UTC](https://discuss.elastic.co/t/need-inode-or-file-timestamp-in-the-event/157711 "2018-11-21T13:19:36Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![laxman1](https://avatars.discourse-cdn.com/v4/letter/l/73ab20/32.png) [@laxman1](https://discuss.elastic.co/u/laxman1)\
**Post date:** [November 21, 2018, 1:19pm UTC](https://discuss.elastic.co/t/need-inode-or-file-timestamp-in-the-event/157711/1 "2018-11-21T13:19:36Z")

</div>

Hi,

We are facing a log rotation problem while filebeat is streaming a particular file. I have a File named Log\_34.txt and when it was streaming it gets renamed to Log\_34.txt2018 and a new file with Log\_34.txt gets created. Now at the logstash we are receiving lines from both the files with the "source" (filename) as same(Log\_34.txt). So we are unable to distinguish whose lines are those. Can we add a Unique ID something like an Inode or a filetimestamp in the event info while filebeat streams. Or can i get any other solution for this problem ?

Thanks

---

<div class="post-metadata">

**Author:** ![pierhugues](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pierhugues/32/48383_2.png) [@pierhugues](https://discuss.elastic.co/u/pierhugues)\
**Post date:** [November 21, 2018, 2:31pm UTC](https://discuss.elastic.co/t/need-inode-or-file-timestamp-in-the-event/157711/2 "2018-11-21T14:31:01Z")

</div>

Hello @laxman1 inside Filebeat we do collect the inode of the file and the volume id but we do not propagate that in the event send to Logstash.

Why do you need that distinction between the files?

---

<div class="post-metadata">

**Author:** ![laxman1](https://avatars.discourse-cdn.com/v4/letter/l/73ab20/32.png) [@laxman1](https://discuss.elastic.co/u/laxman1)\
**Post date:** [November 22, 2018, 2:10pm UTC](https://discuss.elastic.co/t/need-inode-or-file-timestamp-in-the-event/157711/3 "2018-11-22T14:10:33Z")

</div>

Hi @pierhugues ,

I am receiving lines from both the logs with the same filename. In my case the log content from the rotated log and the new log would of different jobs . And logstash events in my case would be processed by different application. So i couldnt associate the content to a Job in my application.

If there is a Inode or someother unique Id for a file created and filebeat propagates it I can distinguish in my application.

---

<div class="post-metadata">

**Author:** ![pierhugues](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pierhugues/32/48383_2.png) [@pierhugues](https://discuss.elastic.co/u/pierhugues)\
**Post date:** [November 22, 2018, 2:20pm UTC](https://discuss.elastic.co/t/need-inode-or-file-timestamp-in-the-event/157711/4 "2018-11-22T14:20:38Z")

</div>

like I've said, we do not send the inode as part of the event.

You said it was two jobs, it might be simplier to use different name per job invocation?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 20, 2018, 2:20pm UTC](https://discuss.elastic.co/t/need-inode-or-file-timestamp-in-the-event/157711/5 "2018-12-20T14:20:45Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.