# NEED TO READ ONLY THE NEWEST FILE IN EACH FOLDER

**URL:** https://discuss.elastic.co/t/need-to-read-only-the-newest-file-in-each-folder/274714
**Category:** Logstash
**Created:** [June 2, 2021, 8:26am UTC](https://discuss.elastic.co/t/need-to-read-only-the-newest-file-in-each-folder/274714 "2021-06-02T08:26:59Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![Daniel\_Lopez](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/daniel_lopez/32/50639_2.png) [@Daniel\_Lopez](https://discuss.elastic.co/u/Daniel_Lopez)
#### Post date: [June 2, 2021, 8:26am UTC](https://discuss.elastic.co/t/need-to-read-only-the-newest-file-in-each-folder/274714/1 "2021-06-02T08:26:59Z")

</div>

Hi guys!!

I need to configure logstash to read only the newest file in folders, when I restart always read all files, and I couldn't understand why, files are in NAS, and I mount folders before start reading.

This is my last input config: (I tried with beginning.end, changing close\_older and ignore\_older values, tail or read mode)

```auto
input {
	file {
		mode => "tail"
		path => "/logs/**/*.ltf" 
		start_position => "end"
		sincedb_path => "/home/monava/db_logs"
    close_older => "1h"
    ignore_older => "1h"
    }
} 

```

The newest file is always writing new lines.

Could some help with this??

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [June 2, 2021, 5:17pm UTC](https://discuss.elastic.co/t/need-to-read-only-the-newest-file-in-each-folder/274714/2 "2021-06-02T17:17:23Z")

</div>

It is possible that if you re-mount the NAS it is being assigned a different device number. That would show up in the sincedb, which is just a text file.

---

<div class="post-metadata">

### Author: ![Daniel\_Lopez](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/daniel_lopez/32/50639_2.png) [@Daniel\_Lopez](https://discuss.elastic.co/u/Daniel_Lopez)
#### Post date: [June 2, 2021, 5:37pm UTC](https://discuss.elastic.co/t/need-to-read-only-the-newest-file-in-each-folder/274714/3 "2021-06-02T17:37:10Z")

</div>

But when I restart logstash with the unit mounted, logstash read again all files...

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [June 2, 2021, 5:51pm UTC](https://discuss.elastic.co/t/need-to-read-only-the-newest-file-in-each-folder/274714/4 "2021-06-02T17:51:47Z")

</div>

If you pick and example file name and search for it in the sincedb then what do you see?

You could try setting log.level to TRACE and seeing what the filewatch module reports (it is voluminous, so redirect logs to a file).

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 30, 2021, 5:52pm UTC](https://discuss.elastic.co/t/need-to-read-only-the-newest-file-in-each-folder/274714/5 "2021-06-30T17:52:20Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
