my application writes log file /var/log/app.log.
At 00:00, this log file is rotated:
mv /var/log/app.log /var/log/app.log.bak
kill -1 <APP_PID> --> re-opens /var/log/app.log
Do I understand it correctly that:
- filebeat will read app.log all day long and send lines to ES. After log file is rotated, filebeat will notice that filename has changed, read all.log.bak until the end of file and then reopen newly created /var/log/app.log?
- if for some reason ES becomes unavailable, filebeat will pause reading file and wait for ES to become reachable again. And then it will continue as described in 1)?