Hello, its because filebeat tracks inode changes to know if it needs to read the file or not. When you are editing with vim, every time that you save your file the inode change. Look at the number on the left in the following example.
ph@sashimi /tmp ls -li testing.log
4305672956 -rw-r--r-- 1 ph wheel 21 Jan 22 10:05 o.log
ph@sashimi /tmp vim o.log
ph@sashimi /tmp ls -li testing.log
4305672969 -rw-r--r-- 1 ph wheel 30 Jan 22 10:05 o.log
ph@sashimi /tmp
When you are using echo
, the inode won't change, this is the normal behavior when you are logging, you are appending to a file.
ph@sashimi /tmp ls -li echo.log
4305673010 -rw-r--r-- 1 ph wheel 2 Jan 22 10:06 echo.log
ph@sashimi /tmp echo "no inode change" >> echo.log
ph@sashimi /tmp ls -li echo.log
4305673010 -rw-r--r-- 1 ph wheel 18 Jan 22 10:06 echo.log