### Author:  [@NIloufarVafaei](https://discuss.elastic.co/u/NIloufarVafaei)
#### Post date: [June 9, 2018, 8:06am UTC](https://discuss.elastic.co/t/reading-from-first/135216/1 "2018-06-09T08:06:37Z")
i use logstash for reading a log file .this file store my service log ,so added some logs during a hours. the point is each time that a log add in my log file , logstash read all log file from first and send it to elasticsearch . how can i fix this config that each time send just latest log to elasticsearch?
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [June 9, 2018, 1:00pm UTC](https://discuss.elastic.co/t/reading-from-first/135216/2 "2018-06-09T13:00:43Z")
Can you show us your logstash input configuration?
---
### Author:  [@Leandro\_Sampaio](https://discuss.elastic.co/u/Leandro_Sampaio)
#### Post date: [June 9, 2018, 2:04pm UTC](https://discuss.elastic.co/t/reading-from-first/135216/3 "2018-06-09T14:04:09Z")
This isn't the normal mode of work from logstash... The logstash store position read from each file and case you kill a process, the same start in correct position
---
### Author:  [@praveen.vemuri](https://discuss.elastic.co/u/praveen.vemuri)
#### Post date: [June 9, 2018, 2:37pm UTC](https://discuss.elastic.co/t/reading-from-first/135216/4 "2018-06-09T14:37:06Z")
Configure sincedb\_path for the file input in logstash.
sincedb\_path
Value type is string
There is no default value for this setting.
Path of the sincedb database file (keeps track of the current position of monitored log files) that will be written to disk. The default will write sincedb files to \/plugins/inputs/file NOTE: it must be a file path and not a directory path
---
### Author:  [@NIloufarVafaei](https://discuss.elastic.co/u/NIloufarVafaei)
#### Post date: [June 10, 2018, 7:33am UTC](https://discuss.elastic.co/t/reading-from-first/135216/5 "2018-06-10T07:33:50Z")
input {
file {
path =\> "/home/adanic/alternatives.log"
type =\> "log"
}
}
filter {
}
output {
elasticsearch {
hosts =\> ["localhost:9200"]
index =\> "doc"
document\_type =\> "%{type}"
}
}
it is my first config
---
### Author:  [@NIloufarVafaei](https://discuss.elastic.co/u/NIloufarVafaei)
#### Post date: [June 10, 2018, 7:36am UTC](https://discuss.elastic.co/t/reading-from-first/135216/6 "2018-06-10T07:36:04Z")
i change my conf and set directly sincedb\_path bud didn't work
hear my second conf
input {
file {
path =\> "/home/adanic/alternatives.log"
type =\> "log"
sincedb\_path =\>"/home/adanic/ee"
}
}
filter {
}
output {
elasticsearch {
hosts =\> ["localhost:9200"]
index =\> "doc"
document\_type =\> "%{type}"
}
}
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [June 10, 2018, 6:16pm UTC](https://discuss.elastic.co/t/reading-from-first/135216/7 "2018-06-10T18:16:39Z")
**Exactly** how are you adding logs to the file? By appending to the file?
---
### Author:  [@NIloufarVafaei](https://discuss.elastic.co/u/NIloufarVafaei)
#### Post date: [June 11, 2018, 4:31am UTC](https://discuss.elastic.co/t/reading-from-first/135216/8 "2018-06-11T04:31:08Z")
yes i append each log to end of the log file
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [June 11, 2018, 5:53am UTC](https://discuss.elastic.co/t/reading-from-first/135216/9 "2018-06-11T05:53:47Z")
How, **exactly**?
---
### Author:  [@NIloufarVafaei](https://discuss.elastic.co/u/NIloufarVafaei)
#### Post date: [June 11, 2018, 7:29am UTC](https://discuss.elastic.co/t/reading-from-first/135216/10 "2018-06-11T07:29:34Z")
well ,i open log file and paste one row of log that i copied and save
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [June 11, 2018, 7:43am UTC](https://discuss.elastic.co/t/reading-from-first/135216/11 "2018-06-11T07:43:25Z")
In a text editor? Then you won't actually append to the file. The text editor will most likely create a new file, write the new data into that file, and rename it into place. To Logstash, this counts as a brand new file.
But the configuration you claim you have is inconsistent with the behavior you describe. Unless you set the file input's `start_position` option to "beginning" Logstash will **under no circumstances** read a file from the beginning (well, okay, unless the file is empty).
---
### Author:  [@NIloufarVafaei](https://discuss.elastic.co/u/NIloufarVafaei)
#### Post date: [June 11, 2018, 7:47am UTC](https://discuss.elastic.co/t/reading-from-first/135216/12 "2018-06-11T07:47:11Z")
you mean i should set start\_position =\> "end"?
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [June 11, 2018, 7:59am UTC](https://discuss.elastic.co/t/reading-from-first/135216/13 "2018-06-11T07:59:52Z")
No, I mean that you shouldn't use a text editor to simulate appending to a log file, because it won't actually be an append operation.
---
### Author:  [@NIloufarVafaei](https://discuss.elastic.co/u/NIloufarVafaei)
#### Post date: [June 11, 2018, 8:06am UTC](https://discuss.elastic.co/t/reading-from-first/135216/14 "2018-06-11T08:06:20Z")
but i test it in windows and it was ok in this way of adding log.
ok i test it with system log file .this file i think use append operation for add log
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 9, 2018, 8:06am UTC](https://discuss.elastic.co/t/reading-from-first/135216/15 "2018-07-09T08:06:39Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.