# Sincedb\_write\_interval not honoured during quiet period

**URL:** <https://discuss.elastic.co/t/sincedb-write-interval-not-honoured-during-quiet-period/106932>\
**Category:** Logstash\
**Created:** [November 8, 2017, 8:54pm UTC](https://discuss.elastic.co/t/sincedb-write-interval-not-honoured-during-quiet-period/106932 "2017-11-08T20:54:56Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![guido4f](https://avatars.discourse-cdn.com/v4/letter/g/9de0a6/32.png) [@guido4f](https://discuss.elastic.co/u/guido4f)\
**Post date:** [November 8, 2017, 8:54pm UTC](https://discuss.elastic.co/t/sincedb-write-interval-not-honoured-during-quiet-period/106932/1 "2017-11-08T20:54:56Z")

</div>

There is an issue with the updating of sincedb, if the files have received and completely order partially processed within a single `sincedb_write_interval;` and no subsequent records are processed the changes and read state is not reflected in sincedb as there are no subsequent events to trigger the check of the write interval

```auto
now = Time.now.to_i
delta = now - @sincedb_last_write
if delta >= @opts[:sincedb_write_interval]

```

This is demonstrable using the following pipeline and copying complete logs files across to the c:\work\logfiles\ directory.  
After the content has been flushed and the files closed, if you look at the sincedb file there will be missing or incomplete records and waiting for them to appear does not help – as there are no events that trigger a sincedb update.

```auto
input {
  file {
    close_older => 20
     path => [
             "c:/work/logfiles/**/*.log*"
             ]
    start_position => "beginning"
    codec => multiline {
              pattern => "^(?!((?:\d{1,4})[\.\/-]\d{1,2}[\.\/-](?:\d{2}){1,2}[\sT]\d{1,2}:[0-5][0-9](:([0-5][0-9]|60))?))"
              what => "previous"
              max_lines => 100000
              charset => "UTF-8"
            }
  }
}
output {
  stdout { codec => rubydebug }
}

```

This means that a non-graceful shutdown will result in the log being reread and reprocessed for further back than the sincedb\_write\_interval; which is not being honoured.

Could we get a sincedb write when the files are closed or the buffer flushed.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 6, 2017, 8:55pm UTC](https://discuss.elastic.co/t/sincedb-write-interval-not-honoured-during-quiet-period/106932/2 "2017-12-06T20:55:03Z")

</div>

Closed on December 6, 2017, 8:55pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.