if a log file isn’t ending with line terminator(like \n), the last line can't be read by harvester.
the harvester of the file will not finished
filebeat version [7.5]
I'm not sure this qualifies as a bug. Filebeat needs a way to know that a log entry is complete. By default it uses newlines to make this determination. In other words, if Filebeat doesn't see a newline it assumes bytes are still being added to the log entry, so it isn't ready to be processed further by Filebeat.
But if the program is coredumped, it can't ensure output a complete log.
It's a very common case.
Maybe filebeat can offer a configuration item to flush the rest buffer when close_inactive is triggered .
After all , the final line terminator never come in this case.
That's an interesting idea, to have a setting like close_inactive_flush or similar.
Would you mind filing a feature request issue for this over here: Sign in to GitHub · GitHub? Please describe your use case in as much detail as you can, so developers can build the feature correctly. Thanks!
Shaunak
ok, I will~
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.