# Regarding ignore fieds

**URL:** <https://discuss.elastic.co/t/regarding-ignore-fieds/317803>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [October 31, 2022, 9:27am UTC](https://discuss.elastic.co/t/regarding-ignore-fieds/317803 "2022-10-31T09:27:33Z")\
**Posts on this page:** 11\
**Page:** 1

<div class="post-metadata">

**Author:** ![yasar](https://avatars.discourse-cdn.com/v4/letter/y/dc4da7/32.png) [@yasar](https://discuss.elastic.co/u/yasar)\
**Post date:** [October 31, 2022, 9:27am UTC](https://discuss.elastic.co/t/regarding-ignore-fieds/317803/1 "2022-10-31T09:27:33Z")

</div>

Hi team,

We would like to explore the ignore fields in Filebeat.

Our purpose is to deleted the older files after denoted the value looks below.

![ignore older](https://us1.discourse-cdn.com/elastic/original/3X/c/8/c867f48e39d4e90712aff36ed2b4f88defa67cc0.png)

After implemented the ignore\_older as 2h in filebeat. The logs has stopped in kibana and it was not deleted as per implemented.

Could you please suggest us, how to delete the older logs and where we need to do that.

Thanks,  
Yasar Arafaath A.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [October 31, 2022, 9:30am UTC](https://discuss.elastic.co/t/regarding-ignore-fieds/317803/2 "2022-10-31T09:30:26Z")

</div>

Please don't post pictures of text, logs or code. They are difficult to read, impossible to search and replicate (if it's code), and some people may not be even able to see them 🙂

---

<div class="post-metadata">

**Author:** ![yasar](https://avatars.discourse-cdn.com/v4/letter/y/dc4da7/32.png) [@yasar](https://discuss.elastic.co/u/yasar)\
**Post date:** [October 31, 2022, 9:35am UTC](https://discuss.elastic.co/t/regarding-ignore-fieds/317803/3 "2022-10-31T09:35:51Z")

</div>

Hello Mark,

Sorry for the inconvenience,

Kindly find the below yaml file from filebeat.

```auto

- type: log
  enabled: true
  paths:
    - /var/log/*
  ignore_older: 2h
  fields_under_root: true
  fields:
       topic_name: -------
       logtype: ----------
 

```

Thanks & Regards,  
Yasar Arafaath A.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [October 31, 2022, 9:50am UTC](https://discuss.elastic.co/t/regarding-ignore-fieds/317803/4 "2022-10-31T09:50:59Z")

</div>

Take a look at [Log input | Filebeat Reference [8.4] | Elastic](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-log.html#filebeat-input-log-ignore-older), it doesn't delete it only ignores files older than that period.

---

<div class="post-metadata">

**Author:** ![yasar](https://avatars.discourse-cdn.com/v4/letter/y/dc4da7/32.png) [@yasar](https://discuss.elastic.co/u/yasar)\
**Post date:** [October 31, 2022, 10:39am UTC](https://discuss.elastic.co/t/regarding-ignore-fieds/317803/5 "2022-10-31T10:39:55Z")

</div>

Hello Mark,

Thanks for the reply,

If we implemented the ignore older like 2h , it will ignore the older logs for 2h.

Here, we have one query..

So, after one 2h we can get the fresh logs only.., right ?? It will ignore the older logs means, we have not getting the 2h of logs that we are implemented ?

Thanks,  
Yasar Arafaath A.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [October 31, 2022, 11:41pm UTC](https://discuss.elastic.co/t/regarding-ignore-fieds/317803/6 "2022-10-31T23:41:25Z")

</div>

Yes, it means that after a file is 2 hours old, Filebeat will stop tracking and reading from it. And will only look at any other files that are less than 2 hours old.

---

<div class="post-metadata">

**Author:** ![yasar](https://avatars.discourse-cdn.com/v4/letter/y/dc4da7/32.png) [@yasar](https://discuss.elastic.co/u/yasar)\
**Post date:** [November 1, 2022, 2:23pm UTC](https://discuss.elastic.co/t/regarding-ignore-fieds/317803/7 "2022-11-01T14:23:14Z")

</div>

Hello Mark,

Thanks for the reply,

And will only look at any other files that are less than 2 hours old

```
 So, we can't receive the older logs after we implemented it.. we can receive only the fresh logs after implemented for 2h right ??

```

Thanks,  
Yasar Arafaath A.

---

<div class="post-metadata">

**Author:** ![yasar](https://avatars.discourse-cdn.com/v4/letter/y/dc4da7/32.png) [@yasar](https://discuss.elastic.co/u/yasar)\
**Post date:** [November 2, 2022, 9:30am UTC](https://discuss.elastic.co/t/regarding-ignore-fieds/317803/8 "2022-11-02T09:30:03Z")

</div>

Hello Mark,

Can i take my perception is correct ?

Thanks,  
Yasar Arafaath A.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [November 2, 2022, 9:58pm UTC](https://discuss.elastic.co/t/regarding-ignore-fieds/317803/9 "2022-11-02T21:58:02Z")

</div>

Yes that is correct.

---

<div class="post-metadata">

**Author:** ![yasar](https://avatars.discourse-cdn.com/v4/letter/y/dc4da7/32.png) [@yasar](https://discuss.elastic.co/u/yasar)\
**Post date:** [November 3, 2022, 7:48am UTC](https://discuss.elastic.co/t/regarding-ignore-fieds/317803/10 "2022-11-03T07:48:42Z")

</div>

Hello Mark,

Thanks for the quick reply.

Thanks,  
Yasar Arafaath A.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 1, 2022, 7:49am UTC](https://discuss.elastic.co/t/regarding-ignore-fieds/317803/11 "2022-12-01T07:49:32Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.