# Read log file that is feed from top not from bottom

**URL:** <https://discuss.elastic.co/t/read-log-file-that-is-feed-from-top-not-from-bottom/81362>\
**Category:** Logstash\
**Created:** [April 5, 2017, 6:30pm UTC](https://discuss.elastic.co/t/read-log-file-that-is-feed-from-top-not-from-bottom/81362 "2017-04-05T18:30:23Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![exorcista](https://avatars.discourse-cdn.com/v4/letter/e/e5b9ba/32.png) [@exorcista](https://discuss.elastic.co/u/exorcista)\
**Post date:** [April 5, 2017, 6:30pm UTC](https://discuss.elastic.co/t/read-log-file-that-is-feed-from-top-not-from-bottom/81362/1 "2017-04-05T18:30:23Z")

</div>

Hi folks.  
I have a log file that is feed from top (new entries are added from top), Is there a way to let know logstash read this file from top?

Thanks in advance.

---

<div class="post-metadata">

**Author:** ![TWalter](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/twalter/32/41239_2.png) [@TWalter](https://discuss.elastic.co/u/TWalter)\
**Post date:** [April 5, 2017, 10:46pm UTC](https://discuss.elastic.co/t/read-log-file-that-is-feed-from-top-not-from-bottom/81362/2 "2017-04-05T22:46:38Z")

</div>

Hey exorcista,

there is a field in the input configuration called "start\_position".

Here the URL of the documentation:  
[https://www.elastic.co/guide/en/logstash/current/plugins-inputs-file.html#plugins-inputs-file-start\_position](https://www.elastic.co/guide/en/logstash/current/plugins-inputs-file.html#plugins-inputs-file-start_position)

On default, the start position of File Input is on the end of the file. If you change the configuration to "beginning", Logstash will read the file from top.

BUT take care ! The change affects only for "new" logfiles that weren't analyzed before. If you want to do this with already analyzed files, you have to change the sincedb path to a new file.

I hope i could help you =)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 3, 2017, 10:46pm UTC](https://discuss.elastic.co/t/read-log-file-that-is-feed-from-top-not-from-bottom/81362/3 "2017-05-03T22:46:54Z")

</div>

Closed on May 3, 2017, 10:46pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.