# Premature file delete when file\_completed\_action is set to "delete"

**URL:** <https://discuss.elastic.co/t/premature-file-delete-when-file-completed-action-is-set-to-delete/299845>\
**Category:** Logstash\
**Created:** [March 16, 2022, 9:12am UTC](https://discuss.elastic.co/t/premature-file-delete-when-file-completed-action-is-set-to-delete/299845 "2022-03-16T09:12:01Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![pinehk](https://avatars.discourse-cdn.com/v4/letter/p/e0b2c6/32.png) [@pinehk](https://discuss.elastic.co/u/pinehk)\
**Post date:** [March 16, 2022, 9:12am UTC](https://discuss.elastic.co/t/premature-file-delete-when-file-completed-action-is-set-to-delete/299845/1 "2022-03-16T09:12:01Z")

</div>

Hi,

The files i needed to push to Elasticsearch for indexing are all "completed" files. To avoid duplicated document I'm trying the file\_completed\_action switch. Setting a document ID is not an option as my data files are not very well structured.

In my logstash config:

```auto
    mode => "read"
    file_completed_action => "delete"

```

And I'm setting filebeat to pick up files. After the above settings, data files are deleted, but then obviously not all lines are feed into Elasticsearch. The count as reported in Elasticsearch index doesn't match with the total line counts for all data files, usually only about 50%-60% of the expected line count. And in fact this count in Elasticsearch differs every time i redo a test run after deleting the index.

Am I missing some configuration settings to make this "delete-after-harvest" function to work? Data files are definitely deleted before they are fully harvested.

Thanks in advance!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 13, 2022, 9:12am UTC](https://discuss.elastic.co/t/premature-file-delete-when-file-completed-action-is-set-to-delete/299845/2 "2022-04-13T09:12:48Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
