title: Logstash File input: sincedb_path
body: <p>Upon restarting Logstash, at times observed that Logstash duplicates the log events. Was wondering as to what would be the right way to apply <code>start_position</code>, <code>sincedb_path</code>, <code>sincedb_write_interval</code> configuration options. </p>
  
  <ul>
  <li>What happens when there are multiple files in the same location as in my example below <code>/home/tom/testData/*.log</code></li>
  <li>What happens when the file rotation occurs like for example the <code>XXX.log</code> file is renamed to <code>XXX-&lt;date&gt;.log</code> and a new <code>XXX.log</code> file is created. In this case name doesn't change, but the inode changes.</li>
  </ul>
  
  <p>Would highly appreciate if anyone can throw some light on this. </p>
  
  <pre><code>input {
             file {
               path =&gt; "/home/tom/testData/*.log"
               type =&gt; "log"
               start_position =&gt; "beginning"
               sincedb_path =&gt; "/persistent/loc"        
               sincedb_write_interval =&gt; 10
                 }
         }
  </code></pre>