title: How can I tell logstash to read file over ssh
body: <p>Using the ELK stack, I have to parse some file but they are remote.
  My solution</p>
  
  <ul>
  <li>rsync over ssh to get the remote file locally</li>
  </ul>
  
  <p>My concern is that my elasticsearch index is growing exponentially (more tha 130MB) whereas the logfile are only 25MB.
  Is that possible that each rsync cron (*/5 mn) leads logstash to read the whole file again without taking the <em>sincedb</em> stuff ?</p>
  
  <p>Thanks for your help :)</p>
  
  <p>The context, I'm using acquia as hoster for drupal site and so I do not have control over how I can access the logfile</p>
  
  <p>Guillaume Renard</p>