# Updating config file
**URL:** https://discuss.elastic.co/t/updating-config-file/286021
**Category:** Logstash
**Created:** [October 6, 2021, 11:52am UTC](https://discuss.elastic.co/t/updating-config-file/286021 "2021-10-06T11:52:03Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@mangeshs](https://discuss.elastic.co/u/mangeshs)
#### Post date: [October 6, 2021, 11:52am UTC](https://discuss.elastic.co/t/updating-config-file/286021/1 "2021-10-06T11:52:03Z")
I have been trial and error technique to solve problems with the logstash
I have been updating the config file input filter and output settings time to time.
so I want to index already present files but at first time it is taking but after I stops logstash and update config file it will taking only changes to files not the from begnnng
---
### Author:  [@grumo35](https://discuss.elastic.co/u/grumo35)
#### Post date: [October 6, 2021, 11:59am UTC](https://discuss.elastic.co/t/updating-config-file/286021/2 "2021-10-06T11:59:51Z")
Hi,
Are you on linux or windows ?
> **[File input plugin | Logstash Reference \[7.15\] | Elastic](https://www.elastic.co/guide/en/logstash/current/plugins-inputs-file.html#plugins-inputs-file-sincedb_path)**
---
### Author:  [@mangeshs](https://discuss.elastic.co/u/mangeshs)
#### Post date: [October 6, 2021, 12:11pm UTC](https://discuss.elastic.co/t/updating-config-file/286021/3 "2021-10-06T12:11:59Z")
both actually, I have to make confirm first on local windows and then on linux server
---
### Author:  [@grumo35](https://discuss.elastic.co/u/grumo35)
#### Post date: [October 6, 2021, 12:16pm UTC](https://discuss.elastic.co/t/updating-config-file/286021/4 "2021-10-06T12:16:02Z")
Ok so your problem seems to be coming from the sincedb\_path directive which says that a file should be read at saved line or from the begining.
On linux it's something like "sincedb\_path \> /dev/null" ( read from the begining at each restart )
and windows "sincedb\_path \> NUL"
Try to look at the documentation good luck 🙂
---
### Author:  [@mangeshs](https://discuss.elastic.co/u/mangeshs)
#### Post date: [October 6, 2021, 12:29pm UTC](https://discuss.elastic.co/t/updating-config-file/286021/5 "2021-10-06T12:29:48Z")
```auto
# Sample Logstash configuration for creating a simple
# Beats -> Logstash -> Elasticsearch pipeline.
input {
file{
path => "C:/ELK_Stack/logstash-7.4.0-1/bin/var/logs/*.log"
#start_position => "beginning"
codec => multiline{
#pattern => "^\s"
#what => "previous"
pattern => "^[0-9]{4}-[0-9]{2}-[0-9]{2}"
negate => true
what => "previous"
}
}
}
filter{
grok {
match => {"message" => "%{TIMESTAMP_ISO8601:time_stamp}\s%{WORD:log_level}\s%{JAVACLASS:class}\s(\[%{DATA:thread}\])\s+(?(.|\r|\n)*)"}
}
mutate{
gsub => ["time_stamp", " ","T"]
}
mutate{
gsub => ["time_stamp", ",","."]
}
mutate{
replace => {"time_stamp" => "%{time_stamp}Z"}
}
}
output {
stdout{
codec => rubydebug
}
elasticsearch {
hosts => ["http://localhost:9200"]
index => "localtest3"
}
}
```
this is my config file for windows
where should I put sincedb option
---
### Author:  [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)
#### Post date: [October 6, 2021, 1:23pm UTC](https://discuss.elastic.co/t/updating-config-file/286021/6 "2021-10-06T13:23:33Z")
As @grumo35 said, it is explained in the [documentation](https://www.elastic.co/guide/en/logstash/current/plugins-inputs-file.html#plugins-inputs-file-sincedb_path), if you want to read a file again you need to set the `sincedb_path` to `NUL` in windows and `/dev/null` in linux.
This setting goes inside the `file` input settings, you also needs to uncomment the `start_position` setting.
So, try something like this:
```auto
input {
file {
path => "C:/ELK_Stack/logstash-7.4.0-1/bin/var/logs/*.log"
start_position => "beginning"
sincedb_path => "NUL"
codec => multiline {
pattern => "^[0-9]{4}-[0-9]{2}-[0-9]{2}"
negate => true
what => "previous"
}
}
}
```
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 3, 2021, 1:23pm UTC](https://discuss.elastic.co/t/updating-config-file/286021/7 "2021-11-03T13:23:41Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.