# Read logs after a particular day?

**URL:** <https://discuss.elastic.co/t/read-logs-after-a-particular-day/1705>\
**Category:** Logstash\
**Created:** [June 2, 2015, 10:51am UTC](https://discuss.elastic.co/t/read-logs-after-a-particular-day/1705 "2015-06-02T10:51:39Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Siddharth\_Trikha](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/siddharth_trikha/32/133867_2.png) [@Siddharth\_Trikha](https://discuss.elastic.co/u/Siddharth_Trikha)\
**Post date:** [June 2, 2015, 10:51am UTC](https://discuss.elastic.co/t/read-logs-after-a-particular-day/1705/1 "2015-06-02T10:51:40Z")

</div>

**BACKGROUND:**

We have `rsyslog` creating log files directories like: `/var/log/rsyslog/SERVER-NAME/LOG-DATE/LOG-FILE-NAME`  
So multiple servers are spilling out their logs of different dates to a central location.

Now to read these logs and store them in elasticsearch for analysing I have my logstash config file something like this:

```
file{
   path => /var/log/rsyslog/**/*.log
}

```

**ISSUE:**

Now we want to read log files after a particular date. Eg If in the directory `/var/log/rsyslog` there are logs of April, May, June 2015 and I want to read all logs after a particular date say \> `15.05.2015`.

Can this be achieved using logstash `file` input?

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [June 2, 2015, 11:07am UTC](https://discuss.elastic.co/t/read-logs-after-a-particular-day/1705/2 "2015-06-02T11:07:02Z")

</div>

No it cannot.

You could use a drop though to just discard things before this date.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:38am UTC](https://discuss.elastic.co/t/read-logs-after-a-particular-day/1705/3 "2017-07-06T05:38:47Z")

</div>