Close_eof data loss?

Filebeat documentation for close_eof says that there can be data loss, can someone explain this a bit better, an example of how data loss can happen ?

I understand the harverster will be close on EOF, and maybe later data will be written to the file, but doesn't a new harvester should open then ?


Only use this option if you understand that data loss is a potential side effect.

When this option is enabled, Filebeat closes a file as soon as the end of a file is reached. This is useful when your files are only written once and not updated from time to time. For example, this happens when you are writing every single log event to a new file. This option is disabled by default.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.