# Read from the beginning filebeat

**URL:** <https://discuss.elastic.co/t/read-from-the-beginning-filebeat/288904>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [November 10, 2021, 3:06pm UTC](https://discuss.elastic.co/t/read-from-the-beginning-filebeat/288904 "2021-11-10T15:06:20Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![rodri.gz](https://avatars.discourse-cdn.com/v4/letter/r/aca169/32.png) [@rodri.gz](https://discuss.elastic.co/u/rodri.gz)\
**Post date:** [November 10, 2021, 3:06pm UTC](https://discuss.elastic.co/t/read-from-the-beginning-filebeat/288904/1 "2021-11-10T15:06:20Z")

</div>

hello!

Is there any parameter to tell an input in filebeat to read from the beginning of the document?  
like the start\_position =\> beginnig of logstash

Thank you!

---

<div class="post-metadata">

**Author:** ![Kaiyan\_Sheng](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kaiyan_sheng/32/38247_2.png) [@Kaiyan\_Sheng](https://discuss.elastic.co/u/Kaiyan_Sheng)\
**Post date:** [November 11, 2021, 5:48am UTC](https://discuss.elastic.co/t/read-from-the-beginning-filebeat/288904/2 "2021-11-11T05:48:10Z")

</div>

Hello! Which input are you looking at to use?

---

<div class="post-metadata">

**Author:** ![rodri.gz](https://avatars.discourse-cdn.com/v4/letter/r/aca169/32.png) [@rodri.gz](https://discuss.elastic.co/u/rodri.gz)\
**Post date:** [November 11, 2021, 11:53am UTC](https://discuss.elastic.co/t/read-from-the-beginning-filebeat/288904/3 "2021-11-11T11:53:21Z")

</div>

Hello!

i want to "delete" or omit de registry from a log or filestream input without delete the registry of the rest with a parameter or something similar like the `start_position => beginnig` of logstash

Thank you!

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [November 11, 2021, 2:04pm UTC](https://discuss.elastic.co/t/read-from-the-beginning-filebeat/288904/4 "2021-11-11T14:04:02Z")

</div>

Filebeat already read files from the beginning, it is the default behaviour.

If you want to read the same file again, then you need to change the registry, the same thing applies to logstash, the `start_position` only matters for the first time logstash reads the file.

---

<div class="post-metadata">

**Author:** ![rodri.gz](https://avatars.discourse-cdn.com/v4/letter/r/aca169/32.png) [@rodri.gz](https://discuss.elastic.co/u/rodri.gz)\
**Post date:** [November 11, 2021, 3:37pm UTC](https://discuss.elastic.co/t/read-from-the-beginning-filebeat/288904/5 "2021-11-11T15:37:02Z")

</div>

but what happens if i have mores than one input?

i've been collecting logs from other paths , is there one registry per input ?  
if i delete de registry it affects to the others inputs?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 9, 2021, 5:37pm UTC](https://discuss.elastic.co/t/read-from-the-beginning-filebeat/288904/6 "2021-12-09T17:37:13Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.