# Reading Old Log files **URL:** \ **Category:** Logstash\ **Created:** [January 20, 2016, 6:20am UTC](https://discuss.elastic.co/t/reading-old-log-files/39620 "2016-01-20T06:20:11Z")\ **Posts on this page:** 13\ **Page:** 1
**Author:** ![novice](https://avatars.discourse-cdn.com/v4/letter/n/a87d85/32.png) [@novice](https://discuss.elastic.co/u/novice)\ **Post date:** [January 20, 2016, 6:20am UTC](https://discuss.elastic.co/t/reading-old-log-files/39620/1 "2016-01-20T06:20:11Z")
Hi, I have ELK Server setup and the logstash keeps reading the old files along with the new ones. How can I prevent that? ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [January 20, 2016, 6:20am UTC](https://discuss.elastic.co/t/reading-old-log-files/39620/2 "2016-01-20T06:20:23Z")
Can we see your config? ---
**Author:** ![novice](https://avatars.discourse-cdn.com/v4/letter/n/a87d85/32.png) [@novice](https://discuss.elastic.co/u/novice)\ **Post date:** [January 20, 2016, 6:28am UTC](https://discuss.elastic.co/t/reading-old-log-files/39620/3 "2016-01-20T06:28:21Z")
Yes sure: Input Config : input { lumberjack { port =\> 5043 type =\> "logs" codec =\> "json" ssl\_certificate =\> "/etc/pki/tls/certs/logstash-forwarder.crt" ssl\_key =\> "/etc/pki/tls/private/logstash-forwarder.key" } } Filter: filter { grok { match =\> ["message","(?[0-9.]{1,6}) %{WORD:method} %{TIMESTAMP\_ISO8601:RequestTime} %{URIPATHPARAM:RequestUrl} %{TIMESTAMP\_ISO8601:RequestTime} %{NUMBER:StatusCode} %{DATA:level}"] tag\_on\_failure =\> [] } } output { elasticsearch { hosts =\> ["localhost:9200"] } stdout { codec =\> rubydebug } } ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [January 20, 2016, 6:29am UTC](https://discuss.elastic.co/t/reading-old-log-files/39620/4 "2016-01-20T06:29:57Z")
So how are your logs getting sent to LS? Cause there isn't anything there that would indicate why this may happen. ---
**Author:** ![novice](https://avatars.discourse-cdn.com/v4/letter/n/a87d85/32.png) [@novice](https://discuss.elastic.co/u/novice)\ **Post date:** [January 20, 2016, 6:37am UTC](https://discuss.elastic.co/t/reading-old-log-files/39620/5 "2016-01-20T06:37:59Z")
oh sorry! The logs get into logstash using logstash forwarder. ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [January 20, 2016, 7:09am UTC](https://discuss.elastic.co/t/reading-old-log-files/39620/6 "2016-01-20T07:09:53Z")
Ok, but you missed my point 🙂 How do logs get to Logstash? ---
**Author:** ![novice](https://avatars.discourse-cdn.com/v4/letter/n/a87d85/32.png) [@novice](https://discuss.elastic.co/u/novice)\ **Post date:** [January 20, 2016, 7:21am UTC](https://discuss.elastic.co/t/reading-old-log-files/39620/7 "2016-01-20T07:21:50Z")
Ohh sorry! The logs get into logstash using LSF (logstash forwarder). ---
**Author:** ![novice](https://avatars.discourse-cdn.com/v4/letter/n/a87d85/32.png) [@novice](https://discuss.elastic.co/u/novice)\ **Post date:** [January 20, 2016, 7:23am UTC](https://discuss.elastic.co/t/reading-old-log-files/39620/8 "2016-01-20T07:23:25Z")
Thats the logstash-forwarder conf at the client: { "network": { "servers": ["log-server:5043"], "ssl certificate": "/etc/logstash/logstash-certs/logstash-forwarder.crt", "ssl ca": "/etc/logstash/logstash-certs/logstash-forwarder.crt", "timeout": 15 }, "files": [ { "paths": ["/opt/logs/\*.log"], "fields": { "type": "log","environment": "production" } }, { "paths": ["/var/log/syslog"], "fields": { "type": "syslog" } } ] ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [January 20, 2016, 8:00am UTC](https://discuss.elastic.co/t/reading-old-log-files/39620/9 "2016-01-20T08:00:20Z")
Ok, LSF is deprecated, you should use [filebeat](https://www.elastic.co/guide/en/beats/filebeat/current/index.html). That aside, I don't see a problem with your config, do things get moved aside on the FS? ---
**Author:** ![novice](https://avatars.discourse-cdn.com/v4/letter/n/a87d85/32.png) [@novice](https://discuss.elastic.co/u/novice)\ **Post date:** [January 20, 2016, 8:16am UTC](https://discuss.elastic.co/t/reading-old-log-files/39620/10 "2016-01-20T08:16:15Z")
Yes. I have migrated few servers from LSF to Filebeat. But I have one doubt, since I have around 100+ servers all sending logs to one single server. What is the best way to scale out? And will this issue go away completely with Filebeat? Andyes we are using logrotate to move the old logs. ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [January 20, 2016, 9:07am UTC](https://discuss.elastic.co/t/reading-old-log-files/39620/11 "2016-01-20T09:07:56Z")
We recommend the use of a broker for that - [https://www.elastic.co/guide/en/logstash/2.1/deploying-and-scaling.html#deploying-message-queueing](https://www.elastic.co/guide/en/logstash/2.1/deploying-and-scaling.html#deploying-message-queueing) ---
**Author:** ![novice](https://avatars.discourse-cdn.com/v4/letter/n/a87d85/32.png) [@novice](https://discuss.elastic.co/u/novice)\ **Post date:** [January 20, 2016, 9:37am UTC](https://discuss.elastic.co/t/reading-old-log-files/39620/12 "2016-01-20T09:37:30Z")
Alright @warkolm thanks a lot. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 5:15am UTC](https://discuss.elastic.co/t/reading-old-log-files/39620/13 "2017-07-06T05:15:04Z")