Do Logstash monitors the folders?

Elastic Stack Logstash
1

Hi All,

I have a special scenario in my application i am using log4j for logging purpose. The maximum size of the log file which i configured is 5 MB , if the file reached to 5 MB it renames the file and take a back up and start logging the logs. So in that case how does the logstash handles the monitoring will it take the renamed file also as a new file and do the parsing ? Please explain me in this scenario.

Thanks and Regards,
Praveen

2

Logstash tracks files via their inode numbers so renamed files will not be treated as new.

3

Thanks @magnusbaeck then even though my file is getting renamed logstash will now re-parse it. Is my understanding correct.

4

If you have file A that's renamed to A.old and then A is recreated, Logstash will not care about A.old but it will start to read new entries from the new file A.

This is at least true with start_position => end (which is the default).

5

Ok Got your point Thanks a lot.