I've started log collection for a cassandra cluster and am seeing some odd behaviour.
That is, when I start the service in debug mode I see the log lines being processed and published to the remote logstash endpoint. However, after a period of time filebeat will start to claim the the log file hasn't changed when then are clearly lines waiting to be processed. The only way to deal with this is to restart the service.
Config looks like this:
filebeat: prospectors: registry_file: /var/lib/filebeat/registry config_dir: /etc/filebeat/conf.d output: logstash: hosts: ["logstash_host:5044"] console: pretty: True shipper: logging: to_files: True files: path: /var/log/filebeat name: filebeat.log rotateeverybytes: 104857600 keepfiles: 5 level: debug