# POTENTIAL BUG? LogStash drops first few events when monitoring multiple files
**URL:** https://discuss.elastic.co/t/potential-bug-logstash-drops-first-few-events-when-monitoring-multiple-files/19689
**Category:** Elasticsearch
**Created:** [September 9, 2014, 3:25pm UTC](https://discuss.elastic.co/t/potential-bug-logstash-drops-first-few-events-when-monitoring-multiple-files/19689 "2014-09-09T15:25:42Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@sale\_chris](https://discuss.elastic.co/u/sale_chris)
#### Post date: [September 9, 2014, 3:25pm UTC](https://discuss.elastic.co/t/potential-bug-logstash-drops-first-few-events-when-monitoring-multiple-files/19689/1 "2014-09-09T15:25:42Z")
OS: Windows 7 SP1 32 bit
LogStash: 1.4.2
Java: jdk1.7.0\_51
I have 2 files, app1.log and app2.log (attached).
My config file (attached) uses the following input:
input {
file {
path =\> [
"C:/elk/app\*.log"
]
start\_position =\> "beginning"
sincedb\_path =\> "C:/elk/.sincedb"
}
}
When processing these two files separately everything works as expected
(see app1-output.txt and app2-output.txt).
If I attempt to process them together or if I do not delete .sincedb after
processing app1.log I get an issue processing app2.log where it appears
that LogStash is 'dropping' the first few lines of the file (see below).
The problem can also be reproduced if referring to the files explicitly...
path =\> ["C:/elk/app1.log", "C:/elk/app2.log"]
I'm checking that I'm not doing something stupid before raising as a bug.
Many thanks, Chris
{
"@version" =\> "1",
"@timestamp" =\> "2014-09-08T23:00:00.000Z",
"host" =\> "LIVLT0111295",
"path" =\> "C:/elk/app1.log",
"message" =\> "Starting...\r"
}
{
"@version" =\> "1",
"@timestamp" =\> "2014-09-08T23:00:01.000Z",
"host" =\> "LIVLT0111295",
"path" =\> "C:/elk/app1.log",
"message" =\> "Started\r"
}
{
"@version" =\> "1",
"@timestamp" =\> "2014-09-08T23:00:02.000Z",
"host" =\> "LIVLT0111295",
"path" =\> "C:/elk/app1.log",
"message" =\> "Listening...\r"
}
{
"@version" =\> "1",
"@timestamp" =\> "2014-09-09T00:00:00.000Z",
"host" =\> "LIVLT0111295",
"path" =\> "C:/elk/app1.log",
"message" =\> "Command received [shutdown]\r"
}
{
"@version" =\> "1",
"@timestamp" =\> "2014-09-09T00:00:01.000Z",
"host" =\> "LIVLT0111295",
"path" =\> "C:/elk/app1.log",
"message" =\> "Shutting down...\r"
}
_{_
-
```
"message" => "\r",*
```
-
```
"@version" => "1",*
```
- "@timestamp" =\> "2014-09-09T14:45:32.364Z",\*
-
```
"host" => "LIVLT0111295",*
```
-
```
"path" => "C:/elk/app2.log",*
```
-
```
"tags" => [*
```
-
```
[0] "_grokparsefailure"*
```
- ]\*
_}_
{
"@version" =\> "1",
"@timestamp" =\> "2014-09-08T23:00:04.000Z",
"host" =\> "LIVLT0111295",
"path" =\> "C:/elk/app2.log",
"message" =\> "Registering 1 listeners(s)\r"
}
{
"@version" =\> "1",
"@timestamp" =\> "2014-09-08T23:00:05.000Z",
"host" =\> "LIVLT0111295",
"path" =\> "C:/elk/app2.log",
"message" =\> "Registered listeners #1\r"
}
{
"@version" =\> "1",
"@timestamp" =\> "2014-09-08T23:00:06.000Z",
"host" =\> "LIVLT0111295",
"path" =\> "C:/elk/app2.log",
"message" =\> "Registration complete successfully\r"
}
--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).
To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/637e110e-f3b8-4a5b-8e73-c42363ab6cc1%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/637e110e-f3b8-4a5b-8e73-c42363ab6cc1%40googlegroups.com).
For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).
---
### Author:  [@jiangdengc](https://discuss.elastic.co/u/jiangdengc)
#### Post date: [October 29, 2014, 2:42am UTC](https://discuss.elastic.co/t/potential-bug-logstash-drops-first-few-events-when-monitoring-multiple-files/19689/2 "2014-10-29T02:42:38Z")
I'm encountered the same issue,so how do you solve it?
--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).
To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/795340f9-18a7-4b2b-a1fa-2680c74be19f%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/795340f9-18a7-4b2b-a1fa-2680c74be19f%40googlegroups.com).
For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 12:53am UTC](https://discuss.elastic.co/t/potential-bug-logstash-drops-first-few-events-when-monitoring-multiple-files/19689/3 "2017-07-06T00:53:17Z")