# Read a constantly overwritten file

**URL:** <https://discuss.elastic.co/t/read-a-constantly-overwritten-file/76177>\
**Category:** Logstash\
**Created:** [February 23, 2017, 9:06am UTC](https://discuss.elastic.co/t/read-a-constantly-overwritten-file/76177 "2017-02-23T09:06:39Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![gringo](https://avatars.discourse-cdn.com/v4/letter/g/f19dbf/32.png) [@gringo](https://discuss.elastic.co/u/gringo)\
**Post date:** [February 23, 2017, 9:06am UTC](https://discuss.elastic.co/t/read-a-constantly-overwritten-file/76177/1 "2017-02-23T09:06:39Z")

</div>

I am currently reading a log file to parse it and send the parsed fields to elasticsearch.

The problem that I am facing now is that new lines are constantly being appended to the log file. I have ran into situations when Logstash stopped but the log file is still growing. i have re-run logstash in order to start parsing the newly added lines.

---

<div class="post-metadata">

**Author:** ![agrawalsaurabh](https://avatars.discourse-cdn.com/v4/letter/a/258eb7/32.png) [@agrawalsaurabh](https://discuss.elastic.co/u/agrawalsaurabh)\
**Post date:** [February 23, 2017, 10:15am UTC](https://discuss.elastic.co/t/read-a-constantly-overwritten-file/76177/2 "2017-02-23T10:15:45Z")

</div>

I am facing similar challenge where the newly added lines are not getting picked by LOGSTASH.

Also if i add a new log file in the same directory, the newly added log file is not getting picked up.

Any help in this regard is much appreciated.

Thanks.

---

<div class="post-metadata">

**Author:** ![gringo](https://avatars.discourse-cdn.com/v4/letter/g/f19dbf/32.png) [@gringo](https://discuss.elastic.co/u/gringo)\
**Post date:** [February 23, 2017, 10:17am UTC](https://discuss.elastic.co/t/read-a-constantly-overwritten-file/76177/3 "2017-02-23T10:17:06Z")

</div>

I am currently reading a file on a mapped network drive which source is a linux file system server

---

<div class="post-metadata">

**Author:** ![agrawalsaurabh](https://avatars.discourse-cdn.com/v4/letter/a/258eb7/32.png) [@agrawalsaurabh](https://discuss.elastic.co/u/agrawalsaurabh)\
**Post date:** [February 23, 2017, 10:18am UTC](https://discuss.elastic.co/t/read-a-constantly-overwritten-file/76177/4 "2017-02-23T10:18:31Z")

</div>

In my case I am simply doing a proof of concept on my laptop which has windows 7 installed. So all software are running on same machine where the log directory is.

---

<div class="post-metadata">

**Author:** ![gringo](https://avatars.discourse-cdn.com/v4/letter/g/f19dbf/32.png) [@gringo](https://discuss.elastic.co/u/gringo)\
**Post date:** [February 23, 2017, 10:21am UTC](https://discuss.elastic.co/t/read-a-constantly-overwritten-file/76177/5 "2017-02-23T10:21:31Z")

</div>

The version that I am using is 2.3.4. What version are you using?

---

<div class="post-metadata">

**Author:** ![agrawalsaurabh](https://avatars.discourse-cdn.com/v4/letter/a/258eb7/32.png) [@agrawalsaurabh](https://discuss.elastic.co/u/agrawalsaurabh)\
**Post date:** [February 23, 2017, 10:23am UTC](https://discuss.elastic.co/t/read-a-constantly-overwritten-file/76177/6 "2017-02-23T10:23:04Z")

</div>

filebeat-5.2.0  
logstash-5.2.0

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 23, 2017, 10:23am UTC](https://discuss.elastic.co/t/read-a-constantly-overwritten-file/76177/7 "2017-03-23T10:23:31Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.