I'm using the file input on my mac, and every time I update the file, it's replaying all messages from the beginning of the log.
I've tried explicitly setting the sincedb_path and start_position vars, but no luck.
.sincedb is created, but I noticed the inode didn't match the file I was updating.
On further investigation, (and I could be wrong), it looks like OSX changes the inode every time the file is updated, not just when a new file is created.
I assume this is the reason it resends all as Logstash thinks it's a new file, but wondering if anyone else has seen this, and/or has a workaround.