# Old file with new name found **URL:** \ **Category:** Beats\ **Tags:** filebeat\ **Created:** [February 15, 2016, 11:08am UTC](https://discuss.elastic.co/t/old-file-with-new-name-found/41766 "2016-02-15T11:08:00Z")\ **Posts on this page:** 12\ **Page:** 2
**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\ **Post date:** [April 12, 2016, 11:57am UTC](https://discuss.elastic.co/t/old-file-with-new-name-found/41766/21 "2016-04-12T11:57:15Z")
For the reference: - Github issue: [https://github.com/elastic/beats/issues/1281](https://github.com/elastic/beats/issues/1281) - PR with potential solution: [https://github.com/elastic/beats/pull/1375](https://github.com/elastic/beats/pull/1375) ---
**Author:** ![lwhitworth](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lwhitworth/32/6940_2.png) [@lwhitworth](https://discuss.elastic.co/u/lwhitworth)\ **Post date:** [May 10, 2016, 1:29pm UTC](https://discuss.elastic.co/t/old-file-with-new-name-found/41766/22 "2016-05-10T13:29:56Z")
Many apologies for my absence on this. I've got back round to being able to look into things and I'm still seeing a stream of INFO messages such as: ``` 2016-05-10T09:05:43+01:00 INFO Old file with new name found: /data/logstash/resnet_argus.archive/2016/04/22/resnet_argus.2016.04.22.08.01.01.0.txt is no /data/logstash/janet_argus.archive/2016/05/10/janet_argus.2016.05.10.08.01.01.0.txt 2016-05-10T14:08:21+01:00 INFO Old file with new name found: /data/logstash/janet_argus.archive/2016/04/04/janet_argus.2016.04.04.14.02.38.0.txt is no /data/logstash/janet_argus.archive/2016/05/10/janet_argus.2016.05.10.13.01.01.0.txt ``` This is running the latest version from repo: `filebeat version 1.2.2 (amd64)` Looking at the registry file for the latter of thatose file names I see: `"/data/logstash/janet_argus.archive/2016/04/04/janet_argus.2016.04.04.14.02.38.0.txt":{"source":"/data/logstash/janet_argus.archive/2016/05/10/janet_argus.2016.05.10.13.01.01.0.txt","offset":270000624,"FileStateOS":{"inode":68303394,"device":64768}}` and `"/data/logstash/janet_argus.archive/2016/05/10/janet_argus.2016.05.10.13.01.01.0.txt":{"source":"/data/logstash/janet_argus.archive/2016/05/10/janet_argus.2016.05.10.13.01.01.0.txt","offset":544320779,"FileStateOS":{"inode":68303394,"` So yes, the files are using the same inode 😡 So million dollar question is how on earth can I get round this??? ---
**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\ **Post date:** [May 10, 2016, 2:50pm UTC](https://discuss.elastic.co/t/old-file-with-new-name-found/41766/23 "2016-05-10T14:50:09Z")
One option to "partially" prevent is to make sure that you create new files before the old one is removed. Second we are currently working on some ideas to use fingerprints for files, so not rely only on inodes. ---
**Author:** ![lwhitworth](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lwhitworth/32/6940_2.png) [@lwhitworth](https://discuss.elastic.co/u/lwhitworth)\ **Post date:** [May 11, 2016, 2:36pm UTC](https://discuss.elastic.co/t/old-file-with-new-name-found/41766/24 "2016-05-11T14:36:00Z")
Cheers for the help, I suppose I could prepopulate a couple of years worth of empty files now ready to be overwritten on their allocated day and hope that that's enough to migitate the issue for now until future magic with fingerprinted files can occur! ---
**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\ **Post date:** [May 12, 2016, 6:43am UTC](https://discuss.elastic.co/t/old-file-with-new-name-found/41766/25 "2016-05-12T06:43:53Z")
That is actually also an interesting idea, like this the inodes are "reserved". ---
**Author:** ![chris.mcdermott](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/chris.mcdermott/32/22662_2.png) [@chris.mcdermott](https://discuss.elastic.co/u/chris.mcdermott)\ **Post date:** [September 22, 2016, 8:01pm UTC](https://discuss.elastic.co/t/old-file-with-new-name-found/41766/26 "2016-09-22T20:01:54Z")
Hi, we are running 1.3.1 and clearly this issue is not fixed. Sep 22 19:57:35 g2t4454c /usr/bin/filebeat[30507]: registrar.go:185: Detected rename of a previously harvested file: /opt/mount1/sa-stats/log/local/fast/fast-20160918073934.log -\> /opt/mount1/sa-stats/log/local/acceptfile/acceptfile.log /opt/mount1/sa-stats/log/local/fast/fast-20160918073934.log was deleted as part of log rotation for one application. /opt/mount1/sa-stats/log/local/acceptfile/acceptfile.log was created a the newest log file for another application. using closer\_older and ignore\_older set to 1hr. Any advice is appreciated. Thanks, Chris ---
**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\ **Post date:** [September 23, 2016, 6:52am UTC](https://discuss.elastic.co/t/old-file-with-new-name-found/41766/27 "2016-09-23T06:52:13Z")
Setting ignore\_older and close\_older does not help with this issue. As there are not options to clean the registry in the 1.x release you must use the 5.x release. beta1 was just released today: [https://www.elastic.co/blog/elastic-stack-release-5-0-0-beta1](https://www.elastic.co/blog/elastic-stack-release-5-0-0-beta1) In the 5.0 release you can use the clean\_\* config options to remove the "old" states from your config file. ---
**Author:** ![chris.mcdermott](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/chris.mcdermott/32/22662_2.png) [@chris.mcdermott](https://discuss.elastic.co/u/chris.mcdermott)\ **Post date:** [September 23, 2016, 6:03pm UTC](https://discuss.elastic.co/t/old-file-with-new-name-found/41766/28 "2016-09-23T18:03:00Z")
Thanks, Mark. I'm going to try with a fresh registry and delete the older log files. ---
**Author:** ![chris.mcdermott](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/chris.mcdermott/32/22662_2.png) [@chris.mcdermott](https://discuss.elastic.co/u/chris.mcdermott)\ **Post date:** [September 26, 2016, 2:24pm UTC](https://discuss.elastic.co/t/old-file-with-new-name-found/41766/29 "2016-09-26T14:24:33Z")
@ruflin, I tried with 1.3.1 with a fresh registry and new set of logs. After the logs started rotating I see the same problem occurring with the misidentified renames. Is there any reason to think that the problem would be fixed with the latest 5.0 code? Sorry for calling you "Mark" in my last post. Don't know how that popped out of my fingers. It might be the first two letters of your last name coupled with that your picture kind of looks like the actor Mark Ruffalo (younger version.) 🙂 Thanks for your help, Chris ---
**Author:** ![chris.mcdermott](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/chris.mcdermott/32/22662_2.png) [@chris.mcdermott](https://discuss.elastic.co/u/chris.mcdermott)\ **Post date:** [September 26, 2016, 3:36pm UTC](https://discuss.elastic.co/t/old-file-with-new-name-found/41766/30 "2016-09-26T15:36:06Z")
I think i answered my own question by looking at [issue-2012](https://github.com/elastic/beats/issues/2012). ---
**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\ **Post date:** [October 2, 2016, 7:48pm UTC](https://discuss.elastic.co/t/old-file-with-new-name-found/41766/31 "2016-10-02T19:48:19Z")
🙂 Let me know in case you still have the issue with the 5.0 release. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 5, 2017, 9:50pm UTC](https://discuss.elastic.co/t/old-file-with-new-name-found/41766/32 "2017-07-05T21:50:34Z")
Closed on July 5, 2017, 9:50pm UTC [Previous page](https://discuss.elastic.co/t/old-file-with-new-name-found/41766.md?page=1)