# Read just the new logs, and stop generation syslog automaticly **URL:** \ **Category:** Logstash\ **Created:** [June 16, 2015, 9:21am UTC](https://discuss.elastic.co/t/read-just-the-new-logs-and-stop-generation-syslog-automaticly/2773 "2015-06-16T09:21:06Z")\ **Posts on this page:** 14\ **Page:** 1
**Author:** ![oussama](https://avatars.discourse-cdn.com/v4/letter/o/e9a140/32.png) [@oussama](https://discuss.elastic.co/u/oussama)\ **Post date:** [June 16, 2015, 9:21am UTC](https://discuss.elastic.co/t/read-just-the-new-logs-and-stop-generation-syslog-automaticly/2773/1 "2015-06-16T09:21:06Z")
Hi, i am using the last versions of logstash, kibana and elasticsearch In fact i have two problem, and i hope that you can help me the first problem is that if i add an other log in access.log, the logstash read all the other logs !!! is that a bug or what ??, and how i specifie to logstash to read just the new log ?? This my code : input { file { path =\> "/root/elastic/access.log" type =\> "apache" } } filter { grok { patterns\_dir =\> "./patterns" match =\> ["message", "%{HTTPDATE:dating}"] } date { locale =\> "fr" match =\> ["dating", "dd/MM/YYYY:HH:mm:ss:SSS"] target =\> "@timestamp" } } output { stdout { codec =\> rubydebug} elasticsearch { protocol =\> "http" host =\> "10.198.114.113" } } The second problem is that the Kibana generate a syslog automaticly(@timestamp)!! so how can i stop this generation and tell kibana to use just the logs specified in the file. Thank you a lot } ---
**Author:** ![eperry](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/eperry/32/551_2.png) [@eperry](https://discuss.elastic.co/u/eperry)\ **Post date:** [June 17, 2015, 7:11am UTC](https://discuss.elastic.co/t/read-just-the-new-logs-and-stop-generation-syslog-automaticly/2773/2 "2015-06-17T07:11:36Z")
Problem 2 look at the "date" filter which you can use the source data instead of the indexing date Problem 1 , based on your configuration it will only read in the access.log. If you had a \* or directory name that might be a different story but you specify a file name so no other files should be read in ---
**Author:** ![oussama](https://avatars.discourse-cdn.com/v4/letter/o/e9a140/32.png) [@oussama](https://discuss.elastic.co/u/oussama)\ **Post date:** [June 17, 2015, 8:05am UTC](https://discuss.elastic.co/t/read-just-the-new-logs-and-stop-generation-syslog-automaticly/2773/3 "2015-06-17T08:05:29Z")
Hi, thanks for your response. problem 2 : can you explain more the solution, I am a beginner with logstash. 🙂 for the problem 1: it read only the access.log, but if i add another logs (line) it read also an other time the old logs in the same file. thanks ---
**Author:** ![eperry](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/eperry/32/551_2.png) [@eperry](https://discuss.elastic.co/u/eperry)\ **Post date:** [June 17, 2015, 12:24pm UTC](https://discuss.elastic.co/t/read-just-the-new-logs-and-stop-generation-syslog-automaticly/2773/4 "2015-06-17T12:24:31Z")
problem 2: Probably should have given you the link for it, sorry [https://www.elastic.co/guide/en/logstash/current/plugins-filters-date.html](https://www.elastic.co/guide/en/logstash/current/plugins-filters-date.html) Can you provide an example config of problem 1 ---
**Author:** ![oussama](https://avatars.discourse-cdn.com/v4/letter/o/e9a140/32.png) [@oussama](https://discuss.elastic.co/u/oussama)\ **Post date:** [June 17, 2015, 2:29pm UTC](https://discuss.elastic.co/t/read-just-the-new-logs-and-stop-generation-syslog-automaticly/2773/5 "2015-06-17T14:29:27Z")
problem 1: for example if i have this logs: my file access.log : 14/06/2015:10:41:24:114 14/06/2015:10:42:24:114 14/06/2015:10:43:24:114 14/06/2015:10:44:24:114 Kibana will read this logs, if i add a logs and i save, my file will be like that : 15/06/2015:10:41:24:114 14/06/2015:10:41:24:114 14/06/2015:10:42:24:114 14/06/2015:10:43:24:114 14/06/2015:10:44:24:114 so kibana read also the other old logs and i will have 9 logs instead of 5 !! ---
**Author:** ![oussama](https://avatars.discourse-cdn.com/v4/letter/o/e9a140/32.png) [@oussama](https://discuss.elastic.co/u/oussama)\ **Post date:** [June 19, 2015, 7:23am UTC](https://discuss.elastic.co/t/read-just-the-new-logs-and-stop-generation-syslog-automaticly/2773/6 "2015-06-19T07:23:20Z")
i can't resolve any problem !!! ---
**Author:** ![colinsurprenant](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/colinsurprenant/32/14776_2.png) [@colinsurprenant](https://discuss.elastic.co/u/colinsurprenant)\ **Post date:** [June 19, 2015, 7:13pm UTC](https://discuss.elastic.co/t/read-just-the-new-logs-and-stop-generation-syslog-automaticly/2773/7 "2015-06-19T19:13:29Z")
Oussama, Using the file input on a file and adding lines to that file using an editor will in fact produce what you described because when saving the file from the editor, a new inode is created and the file input treat it as a new file. To test you should append lines to your file using, for example in Linux: $ echo "foobar" \>\> /root/elastic/access.log Now, for the timestamp parsing, do you have any \_grokparsefailure or \_dataparsefailure tags in your events? Colin ---
**Author:** ![oussama](https://avatars.discourse-cdn.com/v4/letter/o/e9a140/32.png) [@oussama](https://discuss.elastic.co/u/oussama)\ **Post date:** [June 22, 2015, 8:37am UTC](https://discuss.elastic.co/t/read-just-the-new-logs-and-stop-generation-syslog-automaticly/2773/8 "2015-06-22T08:37:23Z")
Hi, thank you very much, now i see why it read an other time. for the timestamp parsing i don't have any \_grokparsefailure or \_dataparsefailure : ![](https://us1.discourse-cdn.com/elastic/original/2X/8/88dd53361e7afa1aa4c9b4036c9406df3f6ecd74.PNG) And in Kibana discover i can't stop the automatic generation for the @timestamp . see the picture ![](https://us1.discourse-cdn.com/elastic/original/2X/e/e3b0b31487069ac0c84bbc1a62d8d5ff09568df3.PNG) Thanks ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [June 25, 2015, 7:16pm UTC](https://discuss.elastic.co/t/read-just-the-new-logs-and-stop-generation-syslog-automaticly/2773/9 "2015-06-25T19:16:34Z")
Logstash will always produce a `@timestamp` field and Kibana relies on that field. Is this a problem for you? ---
**Author:** ![oussama](https://avatars.discourse-cdn.com/v4/letter/o/e9a140/32.png) [@oussama](https://discuss.elastic.co/u/oussama)\ **Post date:** [June 26, 2015, 7:20am UTC](https://discuss.elastic.co/t/read-just-the-new-logs-and-stop-generation-syslog-automaticly/2773/10 "2015-06-26T07:20:20Z")
Hi, Yes that is my problem 🙂 , can i resolve it ? ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [June 26, 2015, 7:28am UTC](https://discuss.elastic.co/t/read-just-the-new-logs-and-stop-generation-syslog-automaticly/2773/11 "2015-06-26T07:28:20Z")
As I said, Kibana relies on the presence of that field. Why is that a problem? (Perhaps Kibana 4 allows the name of the timestamp field to be configured. I haven't checked.) ---
**Author:** ![oussama](https://avatars.discourse-cdn.com/v4/letter/o/e9a140/32.png) [@oussama](https://discuss.elastic.co/u/oussama)\ **Post date:** [June 26, 2015, 7:51am UTC](https://discuss.elastic.co/t/read-just-the-new-logs-and-stop-generation-syslog-automaticly/2773/12 "2015-06-26T07:51:11Z")
Kibana generate a logs automaticly, with type logs or syslog, what i want is to stop this generation or to not display it in the discover, i wanna to kibana to read just the logs from my file logs and display it ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [June 29, 2015, 6:46am UTC](https://discuss.elastic.co/t/read-just-the-new-logs-and-stop-generation-syslog-automaticly/2773/13 "2015-06-29T06:46:55Z")
Kibana is a tool to visualize logs over time. For the "over time" part to be useful there must be a notion of time in the data, and the idea is to have Logstash extract that from the logs (and it happens to store it in the `@timestamp` field). If you just want to display the raw logs I'm not sure what use Kibana is to you. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 5:36am UTC](https://discuss.elastic.co/t/read-just-the-new-logs-and-stop-generation-syslog-automaticly/2773/14 "2017-07-06T05:36:12Z")