Does Filebeat registry file get deleted during reboot

Elastic Stack Beats
1

Hi,

I'm just wondering does the Filebeat registry file get reset or re-created when rebooting the machine the beat is running on ? Is there any way the file could get affected by any operation other than manually deleting file that could cause filebeat to resend data again from all defined logs prospectors ?

Thanks

2

The registry data is not reset by Filebeat. The file is periodically re-written while it's running. The various clean_ configuration options control when Filebeat will remove an individual file record from being tracked in the registry.

3

@andrewkroh thanks for your response! So what would be the default behavior if I have touched non of those options ?

An from your response I assume nothing should be changed when rebooting my Linux machine and Filebeat should continue normally, from where it left off ?

4

Well clean_removed is on by default. Where are the files mounted from? If the inode numbers change on reboot then Filebeat will treat everything as new files.