Does filebeat ever delete file contents?

Elastic Stack Beats
1

Hello everybody!

I have log messages in logstash that I cannot find on the centos server running filebeat (via graylog sidecar).

Just to be 100% sure: Is there any possibility that filebeat is able to delete lines in logfiles after sending them?

Thanks a lot!

2

@ilcoron Logfiles are readonly for filebeat, we never touch them. So you are reading them both with FB and graylog?

3

@pierhugues Graylog provides a filebeat configuration tool called "sidecar" (http://docs.graylog.org/en/2.4/pages/collector_sidecar.html). It is just the way we configure filebeat on the servers.

Thanks a lot for the info!

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.