I have log messages in logstash that I cannot find on the centos server running filebeat (via graylog sidecar).
Just to be 100% sure: Is there any possibility that filebeat is able to delete lines in logfiles after sending them?
Thanks a lot!
@ilcoron Logfiles are readonly for filebeat, we never touch them. So you are reading them both with FB and graylog?
@pierhugues Graylog provides a filebeat configuration tool called "sidecar" (http://docs.graylog.org/en/2.4/pages/collector_sidecar.html). It is just the way we configure filebeat on the servers.
Thanks a lot for the info!
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.