I have a file output that is triggered conditionally set up as:
output {
if [@metadata][dofile] {
file {
path => "/tmp/ts.out"
codec => line { format => "%{[afield]}"}
write_behavior => "overwrite"
}
}
...
}
This works sometimes, but what I observe is that most of the time the file is empty. It seems that if the conditional doesn't match the file is just truncated. If I tail -f
the file I see all the expected data, but doing a cat at random points almost never shows things.
help!