I have two general questions. I'm using the Filebeat to send logs to Logstash. I notice that when I change a file (that is monitored by the Filebeat), the event is published with a delay of ~5-6 seconds. Is this normal? Is this something configurable?
Also, I notice that Filebeat checks the file for any change every 10 seconds:
2017/09/11 13:02:39.322598 prospector_log.go:226: DBG Check file for harvesting: /G/debug.LOG
2017/09/11 13:02:39.322617 prospector_log.go:259: DBG Update existing file for harvesting: /G/debug.LOG, offset: 0
2017/09/11 13:02:39.322629 prospector_log.go:313: DBG File didn't change: /G/debug.LOG
2017/09/11 13:02:39.322644 prospector_log.go:91: DBG Prospector states cleaned up. Before: 2, After: 2
2017/09/11 13:02:39.322884 spooler.go:89: DBG Flushing spooler because of timeout. Events flushed: 0
2017/09/11 13:02:44.323022 spooler.go:89: DBG Flushing spooler because of timeout. Events flushed: 0
2017/09/11 13:02:49.322793 prospector.go:183: DBG Run prospector
2017/09/11 13:02:49.322818 prospector_log.go:70: DBG Start next scan
2017/09/11 13:02:49.322850 prospector_log.go:226: DBG Check file for harvesting: /G/debug.LOG
Can I change this period somehow? For example, to check for any change every 2 second. I searched the yml configuration file but couldn't find any relative timer.
I use version 5.5.2 of Filebeat in Linux Ubuntu.
Thanks in advance,