File output with append only files

Elastic Stack Logstash
1

We are experimenting with setting up a file output to store certain types of logs. Right after the file is created by logstash we are using incron to set the file to append only with chattr +a.

Logstash writes to the file fine after this change. After a period of inactivity logstash closes the file. When it goes to reopen the file it causes a crashing error that it can't access the file.

I'm not seeing any explicit option in the documentation but Is there a way to disable logstash closing the file?

I'm reading through the code to find out https://github.com/logstash-plugins/logstash-output-file

2

Opened issue in github, it looks like the issue is that jruby 1.7.x has a bug with opening files in append only mode

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.