ERR " write: broken pipe"

Hello, its because filebeat tracks inode changes to know if it needs to read the file or not. When you are editing with vim, every time that you save your file the inode change. Look at the number on the left in the following example.

ph@sashimi  /tmp  ls -li testing.log
4305672956 -rw-r--r--  1 ph  wheel  21 Jan 22 10:05 o.log
 ph@sashimi  /tmp  vim o.log
 ph@sashimi  /tmp  ls -li testing.log
4305672969 -rw-r--r--  1 ph  wheel  30 Jan 22 10:05 o.log
 ph@sashimi  /tmp 

When you are using echo, the inode won't change, this is the normal behavior when you are logging, you are appending to a file.

ph@sashimi  /tmp  ls -li echo.log
4305673010 -rw-r--r--  1 ph  wheel  2 Jan 22 10:06 echo.log
 ph@sashimi  /tmp  echo "no inode change" >> echo.log
 ph@sashimi  /tmp  ls -li echo.log
4305673010 -rw-r--r--  1 ph  wheel  18 Jan 22 10:06 echo.log
2 Likes