Every time read file from beginning when modified

Elastic Stack Beats
1

HI,

I have a use case where a file is replaced with additional details periodically. I was using filebeat to do that but I see filebeat maintains an offset and considers it as same file and starts reading from the line where it left. causing the data loss.
Is there a way that I can always force filebeat to read the file from beginning whenever it is modified/replaced?

Other option that I found was using file input plugin that offers this option with setting since_db as /dev/null and start_position as "beginning". However my file is remote so can not use that plugin.

Please suggest.

2

I think you need to review some rules regarding the log rotation: https://www.elastic.co/guide/en/beats/filebeat/current/file-log-rotation.html

3

In my case every day a new file is placed in the directory . 1 file is maintained per day and and is replaced every our within a day .

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.