# Query on Logstash S3 input
**URL:** https://discuss.elastic.co/t/query-on-logstash-s3-input/325964
**Category:** Logstash
**Created:** [February 20, 2023, 11:18am UTC](https://discuss.elastic.co/t/query-on-logstash-s3-input/325964 "2023-02-20T11:18:08Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@pk.241011](https://discuss.elastic.co/u/pk.241011)
#### Post date: [February 20, 2023, 11:18am UTC](https://discuss.elastic.co/t/query-on-logstash-s3-input/325964/1 "2023-02-20T11:18:08Z")
Hi Team,
I wanted some clarification on the Logstash S3 input plugin behaviour.
There is an option of "sincedb\_path" where as per documentation, it defines where to write the since database (keeps track of the date the last handled file was added to S3).
I am not sure what happens when S3 lifecycle policies move the files around, say from standard storage to S3 Standard-IA storage class or S3 Glacier Flexible Retrieval storage class.
Will logstash consider the files state to have changed and read them back again?
If so I will put in a mitigation of deleting files after they have been read.
But if the implementation assures that the incoming files will be read only once (despite the changes in the storage class of the files) then it makes my life much simpler.
---
### Author:  [@pk.241011](https://discuss.elastic.co/u/pk.241011)
#### Post date: [February 27, 2023, 11:12am UTC](https://discuss.elastic.co/t/query-on-logstash-s3-input/325964/2 "2023-02-27T11:12:59Z")
Thread bump.
If someone can chime in it will be great.
---
### Author:  [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)
#### Post date: [February 27, 2023, 1:12pm UTC](https://discuss.elastic.co/t/query-on-logstash-s3-input/325964/3 "2023-02-27T13:12:34Z")
I don't think the date of when a file was added to s3 will change when it is moved to a different storage class, so it would make no difference.
Also, this input does not read anything that is on Glacier.
---
### Author:  [@pk.241011](https://discuss.elastic.co/u/pk.241011)
#### Post date: [February 27, 2023, 9:13pm UTC](https://discuss.elastic.co/t/query-on-logstash-s3-input/325964/4 "2023-02-27T21:13:39Z")
Thanks for the reply. I was a bit worried as long time ago filebeat had this issue of getting confused when reading from windows network/shared drives (it was not a recommended way of using filebeats anyways).
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 27, 2023, 9:14pm UTC](https://discuss.elastic.co/t/query-on-logstash-s3-input/325964/5 "2023-03-27T21:14:16Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.