# Strange behaviour - Logstash forwarder read logs fine however the logfile is 0 byte

**URL:** <https://discuss.elastic.co/t/strange-behaviour-logstash-forwarder-read-logs-fine-however-the-logfile-is-0-byte/2033>\
**Category:** Logstash\
**Created:** [June 5, 2015, 6:03pm UTC](https://discuss.elastic.co/t/strange-behaviour-logstash-forwarder-read-logs-fine-however-the-logfile-is-0-byte/2033 "2015-06-05T18:03:07Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![m\_abdelfattah](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/m_abdelfattah/32/433_2.png) [@m\_abdelfattah](https://discuss.elastic.co/u/m_abdelfattah)\
**Post date:** [June 5, 2015, 6:03pm UTC](https://discuss.elastic.co/t/strange-behaviour-logstash-forwarder-read-logs-fine-however-the-logfile-is-0-byte/2033/1 "2015-06-05T18:03:07Z")

</div>

We are using Logstash-forwarder to send Nginx access logs to remote Logstash server, but there is something strange, that the access.log file size is 0 byte and nginx is writing to access.log.1 ( I know this is not the right place to ask Why).

Here is Logstash-forwarder configuration:

```
{
  "files": [
    {
      "paths": [
        "/var/log/nginx/access.log"
      ],
      "fields": { "type": "nginx-access" }
    },
  ]
}

```

And Here is the ls for nginx folder

```
root@eg-lb:~# ls -alh /var/log/nginx
total 355M
drwxr-x--- 2 www-data adm 4.0K Jun 2 06:16 .
drwxr-xr-x 14 root root 4.0K Jun 5 06:16 ..
-rw-r----- 1 www-data adm 0 Jun 2 06:16 access.log
-rw-r----- 1 www-data adm 355M Jun 5 19:59 access.log.1

```

But everything I can see in access.log.1 when I tail, I find it also in our ELK stack!

So, can anyone tell me what's wrong?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:38am UTC](https://discuss.elastic.co/t/strange-behaviour-logstash-forwarder-read-logs-fine-however-the-logfile-is-0-byte/2033/2 "2017-07-06T05:38:23Z")

</div>