I have a question. I am trying to backfill some old logs into our ELK stack. In order to do that, I created a simple configuration file like this :
filebeat: prospectors: - paths: - "-" input_type: stdin document_type: nginx fields_under_root: true fields: environment: staging output: logstash: hosts: ["example.com:5044"]
zcat my old log file and pipe the result into
filebeat telling it to use this configuration file.
The command I am using looks like this :
sudo zcat /var/log/nginx/access.log-20160101.gz | filebeat -e -v -c /etc/filebeat-stdin-nginx.yml
My issue is that
filebeat keeps running once it reached the end of the input, waiting for new lines on
stdin I suppose. Is there a way to tell it to stop ?
I want to write some scripts to perform the backfilling. This behavior makes it hard to write them. Maybe I should backfill logs another way.
Thanks for your awesome work.