Filebeat documentation for close_eof says that there can be data loss, can someone explain this a bit better, an example of how data loss can happen ?
I understand the harverster will be close on EOF, and maybe later data will be written to the file, but doesn't a new harvester should open then ?
close_eof
edit
Warning
Only use this option if you understand that data loss is a potential side effect.
When this option is enabled, Filebeat closes a file as soon as the end of a file is reached. This is useful when your files are only written once and not updated from time to time. For example, this happens when you are writing every single log event to a new file. This option is disabled by default.