# Restarting Filebeat, replay all data of a file

**URL:** <https://discuss.elastic.co/t/restarting-filebeat-replay-all-data-of-a-file/106630>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [November 7, 2017, 6:13am UTC](https://discuss.elastic.co/t/restarting-filebeat-replay-all-data-of-a-file/106630 "2017-11-07T06:13:41Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![onezero-jung](https://avatars.discourse-cdn.com/v4/letter/o/e480ec/32.png) [@onezero-jung](https://discuss.elastic.co/u/onezero-jung)\
**Post date:** [November 7, 2017, 6:13am UTC](https://discuss.elastic.co/t/restarting-filebeat-replay-all-data-of-a-file/106630/1 "2017-11-07T06:13:41Z")

</div>

Filebeat sand data again in a file when restarting  
paths property is setted with absolute path. It is work well( Restarting filbert, does not send duplicate data)  
but setting with relative path, send duplicate data.  
Is it bug?

filebeat.prospectors:

- input\_type: log  
paths:
  - /home1/irteam/datalog/\*.log

...

output.console:  
pretty: true

test input file

$ echo "test 1" \>\> /home1/irteam/datalog/test.log  
$ echo "test 2" \>\> /home1/irteam/datalog/test.log  
$ echo "test 3" \>\> /home1/irteam/datalog/test.log

result output : console output work well

$ ./filebeat -c ./filebeat.yml

{"@timestamp":"2017-10-25T05:32:23.693Z","beat":{"hostname":"Naverui-MacBook-Pro-182.local","name":"Naverui-MacBook-Pro-182.local","version":"5.6.0"},"input\_type":"log","message":"test 1","offset":7,"source":"/Users/Naver/filebeat/beats/filebeat/datalog/test.log","type":"log"}  
{"@timestamp":"2017-10-25T05:32:48.696Z","beat":{"hostname":"Naverui-MacBook-Pro-182.local","name":"Naverui-MacBook-Pro-182.local","version":"5.6.0"},"input\_type":"log","message":"test 2","offset":14,"source":"/Users/Naver/filebeat/beats/filebeat/datalog/test.log","type":"log"}  
{"@timestamp":"2017-10-25T05:32:48.696Z","beat":{"hostname":"Naverui-MacBook-Pro-182.local","name":"Naverui-MacBook-Pro-182.local","version":"5.6.0"},"input\_type":"log","message":"test 3","offset":21,"source":"/Users/Naver/filebeat/beats/filebeat/datalog/test.log","type":"log"}

But setted with relative path like below.  
appended event output work well but restarting filebeat, old data send again

filebeat.prospectors:

- input\_type: log  
paths:
  - ./datalog/\*.log

$ echo "test 1" \>\> /home1/irteam/datalog/test.log  
$ echo "test 2" \>\> /home1/irteam/datalog/test.log  
$ echo "test 3" \>\> /home1/irteam/datalog/test.log

./filebeat -c ./filebeat.yml  
{"@timestamp":"2017-10-25T05:42:09.732Z","beat":{"hostname":"Naverui-MacBook-Pro-182.local","name":"Naverui-MacBook-Pro-182.local","version":"5.6.0"},"input\_type":"log","message":"test 1","offset":7,"source":"/Users/Naver/filebeat/beats/filebeat/datalog/test.log","type":"log"}  
{"@timestamp":"2017-10-25T05:42:09.732Z","beat":{"hostname":"Naverui-MacBook-Pro-182.local","name":"Naverui-MacBook-Pro-182.local","version":"5.6.0"},"input\_type":"log","message":"test 2","offset":14,"source":"/Users/Naver/filebeat/beats/filebeat/datalog/test.log","type":"log"}  
{"@timestamp":"2017-10-25T05:42:09.732Z","beat":{"hostname":"Naverui-MacBook-Pro-182.local","name":"Naverui-MacBook-Pro-182.local","version":"5.6.0"},"input\_type":"log","message":"test 3","offset":21,"source":"/Users/Naver/filebeat/beats/filebeat/datalog/test.log","type":"log"}

---

<div class="post-metadata">

**Author:** ![kvch](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kvch/32/72058_2.png) [@kvch](https://discuss.elastic.co/u/kvch)\
**Post date:** [November 7, 2017, 2:13pm UTC](https://discuss.elastic.co/t/restarting-filebeat-replay-all-data-of-a-file/106630/2 "2017-11-07T14:13:51Z")

</div>

Hi!

Yes, it is a known bug: [https://github.com/elastic/beats/issues/5442](https://github.com/elastic/beats/issues/5442)  
The fix will be released in Filebeat 6.1.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 5, 2017, 2:14pm UTC](https://discuss.elastic.co/t/restarting-filebeat-replay-all-data-of-a-file/106630/3 "2017-12-05T14:14:41Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.