# Read latest logs from a file

**URL:** https://discuss.elastic.co/t/read-latest-logs-from-a-file/384957
**Category:** Beats
**Tags:** filebeat
**Created:** [February 7, 2026, 1:19pm UTC](https://discuss.elastic.co/t/read-latest-logs-from-a-file/384957 "2026-02-07T13:19:17Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![Aniket\_Pant](https://avatars.discourse-cdn.com/v4/letter/a/77aa72/32.png) [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)
#### Post date: [February 7, 2026, 1:19pm UTC](https://discuss.elastic.co/t/read-latest-logs-from-a-file/384957/1 "2026-02-07T13:19:17Z")

</div>

Hello Folks,

I have one log file and it is containing all logs since November 2025 to till now. For doing the parsing of logs i’ve copy-paste sample logs to test.log file and it worked. My question is

1. How to read last 3 days of logs ?(As the user have one single log file which is not rotating)
2. Or How to read latest logs.

I have used ignore\_older option but it give me all the logs because i have copy paste sample logs .I have used tail option it worked . Is there any other way to read

---

<div class="post-metadata">

### Author: ![Tortoise](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tortoise/32/147587_2.png) [@Tortoise](https://discuss.elastic.co/u/Tortoise)
#### Post date: [February 8, 2026, 10:06am UTC](https://discuss.elastic.co/t/read-latest-logs-from-a-file/384957/2 "2026-02-08T10:06:09Z")

</div>

Hello @Aniket_Pant

I believe there are 2 ways :

1. Is to dissect & drop the messages :

```auto
processors:
  - grok:
      field: message
      patterns:
        - '%{TIMESTAMP_ISO8601:log_timestamp} %{GREEDYDATA:msg}'

  - date:
      field: log_timestamp
      target_field: "@timestamp"
      formats:
        - ISO8601

  - drop_event:
      when:
        range:
          "@timestamp":
            lt: "now-3d"

```

2. Index all the data & delete older data from index :

```auto
POST your-index-name/_delete_by_query
{
  "query": {
    "range": {
      "@timestamp": {
        "lt": "now-3d"
      }
    }
  }
}

```

Thanks!!