Hello,
Good news, I've reproduced the behavior under Win7 with my little sample program.
Then, with 5.0.0-alpha4 this does't duplicate data on rollover.
If you want code to reproduce:
https://github.com/blavoie/filebeat-rotate-test
I will send the latest binary file to ops to make the update on each servers.
Just to be safe, as stated here:
@logstash_oz @wmcdonald The newest version of filebeat (5.0.0-alpha3) now relies much less on the modification date for harvesting. Could you try out if this version resolves the above issues?
And seen here:
// It is important here that only the size is checked and not modification time, as modification time could be incorrect on windows
// https://blogs.technet.microsoft.com/asiasupp/2010/12/14/file-date-modified-property-are-not-updating-while-modifying-a-file-without-closing-it/
if oldState.Finished && newState.Fileinfo.Size() > newState.Offset {
The harvester doesn't monitor file based on moddate but now on size?
Is it safe to make close_older to something more appropriate? 30h --> 1h
Thanks
Bruno Lavoie