How to Force Logstash to Reparse a File?

Better Stack Team
Updated on April 2, 2024

By default, Logstash's file input plugin tracks the parts of a file it has already processed. However, when you want Logstash to reparse a file starting from the beginning, you would need to set the sincedb_path option to /dev/null as demonstrated in the following code:

input {
  file {
    path => ["/var/logs/my_logfile"]
    start_position => "beginning"
    sincedb_path => "/dev/null"

This configuration sets up the Logstash file input plugin to read logs from the specified file path. It instructs Logstash to read from the beginning of the file by setting its start_position to beginning. Additionally, it disables sincedb tracking by assigning /dev/null, enabling the file to be reprocessed.

Got an article suggestion? Let us know
Explore more
Licensed under CC-BY-NC-SA

This work is licensed under a Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International License.

Make your mark

Join the writer's program

Are you a developer and love writing and sharing your knowledge with the world? Join our guest writing program and get paid for writing amazing technical guides. We'll get them to the right readers that will appreciate them.

Write for us
Writer of the month
Marin Bezhanov
Marin is a software engineer and architect with a broad range of experience working...
Build on top of Better Stack

Write a script, app or project on top of Better Stack and share it with the world. Make a public repository and share it with us at our email.

or submit a pull request and help us build better products for everyone.

See the full list of amazing projects on github