I have a special scenario in my application i am using log4j for logging purpose. The maximum size of the log file which i configured is 5 MB , if the file reached to 5 MB it renames the file and take a back up and start logging the logs. So in that case how does the logstash handles the monitoring will it take the renamed file also as a new file and do the parsing ? Please explain me in this scenario.
Thanks and Regards,
Logstash tracks files via their inode numbers so renamed files will not be treated as new.
Thanks @magnusbaeck then even though my file is getting renamed logstash will now re-parse it. Is my understanding correct.
If you have file A that's renamed to A.old and then A is recreated, Logstash will not care about A.old but it will start to read new entries from the new file A.
This is at least true with
start_position => end (which is the default).
Ok Got your point Thanks a lot.
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.