Does filebeat work with logrotation using compress mode?

Elastic Stack Beats
1

Hello.

I am planning to use the filebeat to collect logs. All the logs will be rotated using logrotate command for linux Reading the posts I understood that filebeat keeps track of data by inode.

However, if the logs are rotated using compress mode , I assume specifying the path in the prospectors as message* is not a good idea.

filebeat.prospectors:
- input_type: log
  paths:
     - /var/log/messages*

Is there any specific combination of configuration options which I need to specify for my case?

2

when compressing logs, you often append .gz to the file names. How many files to you keep as plaintext? You can either define all patterns or use exclude_files with '\.gz$' to filter out all compressed files.

3

@steffens

Thank you for the reply.

I am considerting about up to 31 days of text files and rest with gz files.
Looks like excluding gz extension will work out for me.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.