# "Overwritten" files & logstash

**URL:** <https://discuss.elastic.co/t/overwritten-files-logstash/87405>\
**Category:** Logstash\
**Created:** [May 29, 2017, 7:35am UTC](https://discuss.elastic.co/t/overwritten-files-logstash/87405 "2017-05-29T07:35:42Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![mitabrev](https://avatars.discourse-cdn.com/v4/letter/m/a88e57/32.png) [@mitabrev](https://discuss.elastic.co/u/mitabrev)\
**Post date:** [May 29, 2017, 7:35am UTC](https://discuss.elastic.co/t/overwritten-files-logstash/87405/1 "2017-05-29T07:35:43Z")

</div>

Hi guys,

Got one question.  
I would like to create bash scripts from my elastic server to harvest log files from remote directories. It would be probably very often, that one log file would be overwritten with the same file during the script automation.

What will logstash/sincedb do?  
-filename \<- remains the same  
-filesize \<- remains the same  
-filecontent \<-remains the same

only change would be to last modification time on the local server.

Will logstash see this file as "old" and ignore it or will in repharse it and make duplicate entries to elastic?

Thank you and have a nice day.  
Mario

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [May 29, 2017, 6:51pm UTC](https://discuss.elastic.co/t/overwritten-files-logstash/87405/2 "2017-05-29T18:51:28Z")

</div>

In-place overwriting of the kind you're describing should be fine. I don't see why you'd get any duplicates.

---

<div class="post-metadata">

**Author:** ![mitabrev](https://avatars.discourse-cdn.com/v4/letter/m/a88e57/32.png) [@mitabrev](https://discuss.elastic.co/u/mitabrev)\
**Post date:** [May 30, 2017, 11:29am UTC](https://discuss.elastic.co/t/overwritten-files-logstash/87405/3 "2017-05-30T11:29:43Z")

</div>

Thank you Magnus. I can confirm.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 27, 2017, 11:29am UTC](https://discuss.elastic.co/t/overwritten-files-logstash/87405/4 "2017-06-27T11:29:45Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.