# Offset mssql logs

**URL:** <https://discuss.elastic.co/t/offset-mssql-logs/235542>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [June 3, 2020, 12:05pm UTC](https://discuss.elastic.co/t/offset-mssql-logs/235542 "2020-06-03T12:05:46Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![GedeoN](https://avatars.discourse-cdn.com/v4/letter/g/e9c0ed/32.png) [@GedeoN](https://discuss.elastic.co/u/GedeoN)\
**Post date:** [June 3, 2020, 12:05pm UTC](https://discuss.elastic.co/t/offset-mssql-logs/235542/1 "2020-06-03T12:05:46Z")

</div>

Hi,

I'm working on a solution to send mssql logs to Elasticsearch.  
The global solution is working, but i don't have solution to only send the difference.

In thirst time, I copy and encoding mssql logs files in an other folder.  
And I use filebeat to send these files to logstash.

filebeat configuration:

```auto
filebeat.inputs:
  
- type: log
  encoding: UTF-8
  enabled: true
  paths:
    - E:/sources/Log/FDLAUNCHERRORLOG*
  tags: ["FDLAUNCHERRORLOGPPD"]
  scan_frequency: 120s
  fields:
    log_type: fdlauncherrorlogppd
  close_inactive: 3600m
  
- type: log
  encoding: UTF-8
  enabled: true
  paths:
    - E:/sources/Log/SQLAGENT*
  tags: ["SQLAGENTPPD"]
  scan_frequency: 120s
  fields:
    log_type: sqlagentppd
  close_inactive: 3600m
  
- type: log
  encoding: UTF-8
  enabled: true
  paths:
    - E:/sources/Log/ERRORLOG*
  tags: ["ERRORLOGPPD"]
  scan_frequency: 120s
  fields:
    log_type: errorlogppd
  close_inactive: 3600m

```

My problem, it always copying all files, and i just would have the difference after copy.  
Many files are archives, so i can send them manually for one time.  
But ERRORLOG always evolved, and i would to send just the new lines on file and not all.

Is any solution exist to have an offset on file?  
Sorry for my English, i hope it's understandable.

Best regards.  
Jonathan

---

<div class="post-metadata">

**Author:** ![kvch](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kvch/32/72058_2.png) [@kvch](https://discuss.elastic.co/u/kvch)\
**Post date:** [June 3, 2020, 4:19pm UTC](https://discuss.elastic.co/t/offset-mssql-logs/235542/2 "2020-06-03T16:19:05Z")

</div>

Are the log files you are reading located on a network share? What copies the files?

To exclude archives you can use the `exclude_files` option to filter out files with a specific name or extension. See more: [https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-log.html#filebeat-input-log-exclude-files](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-log.html#filebeat-input-log-exclude-files)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 1, 2020, 4:19pm UTC](https://discuss.elastic.co/t/offset-mssql-logs/235542/3 "2020-07-01T16:19:05Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.