Does filebeat work with logrotation using compress mode?


I am planning to use the filebeat to collect logs. All the logs will be rotated using logrotate command for linux Reading the posts I understood that filebeat keeps track of data by inode.

However, if the logs are rotated using compress mode , I assume specifying the path in the prospectors as message* is not a good idea.

- input_type: log
     - /var/log/messages*

Is there any specific combination of configuration options which I need to specify for my case?

when compressing logs, you often append .gz to the file names. How many files to you keep as plaintext? You can either define all patterns or use exclude_files with '\.gz$' to filter out all compressed files.


Thank you for the reply.

I am considerting about up to 31 days of text files and rest with gz files.
Looks like excluding gz extension will work out for me.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.