# Scalability of Logstash when using path =\> "/path/to/file/\*/\*/\*/\*/\*/test.log"

**URL:** https://discuss.elastic.co/t/scalability-of-logstash-when-using-path-path-to-file-test-log/229143
**Category:** Logstash
**Created:** [April 21, 2020, 11:19pm UTC](https://discuss.elastic.co/t/scalability-of-logstash-when-using-path-path-to-file-test-log/229143 "2020-04-21T23:19:03Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![david4](https://avatars.discourse-cdn.com/v4/letter/d/8e7dd6/32.png) [@david4](https://discuss.elastic.co/u/david4)
#### Post date: [April 21, 2020, 11:19pm UTC](https://discuss.elastic.co/t/scalability-of-logstash-when-using-path-path-to-file-test-log/229143/1 "2020-04-21T23:19:03Z")

</div>

Hello,

I'm new to the ELK stack and trying to write a Logstash configuration file to monitor a dynamic file structure. I already have two approaches that work, but really want to learn which is a better way.

**Approach 1:**

```auto
input {
  file {
    path => "/tasks/ **/** / **/** /**/test.log" 
  }
}

```

**Approach 2 (with the help of a Logstash feature, reloading the config file):**

```auto
input {
  file {
    path => "/tasks/2020/July/31/23/59/task1/test.log" 
  }
}

```

Basically, there is **only one** `test.log` (produced by a task like in the second example) **that needs to be parsed by Logstash at any given time** (Logstash shouldn't listen to the old logs such as from `task0` anymore), but since the file structure in between keeps changing, I'm not sure if approach 1 can scale when there are millions tasks coming.

For the second approach, I'm lucky to come across a Logstash feature that allows me to [reload the config file](https://www.elastic.co/guide/en/logstash/current/reloading-config.html) every time there is a new `test.log` so Logstash doesn't need to listen to the old logs anymore). For example, I can change  
`path => "/tasks/2020/July/31/23/59/task1/test.log"`  
to  
`path => "/tasks/2021/August/21/23/59/task1000/test.log"` if I want.

**Questions:**  
Which approach do you think will work better in my situation ? Or can you explain me how Logstash file input plugin works when I use a pattern like `"/tasks/ **/** / **/** /**/test.log"` ? Does it search every second ? Does keeping track of the old logs that would never be updated again affect the performance of Logstash ?

Thank you very much !!!

---

<div class="post-metadata">

### Author: ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [April 22, 2020, 2:37am UTC](https://discuss.elastic.co/t/scalability-of-logstash-when-using-path-path-to-file-test-log/229143/2 "2020-04-22T02:37:57Z")

</div>

It might make more sense to use Filebeat here, it has [recursive globbing](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-log.html#recursive_glob) that should make things a little easier in the config file.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 20, 2020, 2:47am UTC](https://discuss.elastic.co/t/scalability-of-logstash-when-using-path-path-to-file-test-log/229143/3 "2020-05-20T02:47:20Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
