Filebeat 6.6.1(arm build) Harvester generate different inode for the same file

Elastic Stack Beats
1

Hello,
I build the filebeat for ARM according to the wiki How to install Filebeat on a ARM based SBC (eg. Raspberry Pi 3)

Then i replace the filebeat in filebeat-6.1.1-linux-x86_64 with my just built filebeat. It does work.
However, i found that when i modify my input, filebeat will create a new harvester for the file and check the input from the beginning.
I found in the registry file, file beat generate a new inode for the same file when i make any modify. If i test the official firebeat release 6.61 with mac version, i don't see this behavior. Is there any way to solve the problem in arm build? below is the example in my registry for arm build

[{"source":"/root/test.log","offset":1363,"timestamp":"2019-03-12T14:34:43.934308102+08:00","ttl":-1,"type":"log","meta":null,"FileStateOS":{"inode":38450,"device":45829}},{"source":"/root/test.log","offset":1376,"timestamp":"2019-03-12T14:36:13.941900602+08:00","ttl":-1,"type":"log","meta":null,"FileStateOS":{"inode":2874,"device":45829}},{"source":"/root/test.log","offset":0,"timestamp":"2019-03-12T14:36:42.942688504+08:00","ttl":-1,"type":"log","meta":null,"FileStateOS":{"inode":38479,"device":45829}}]

Every time i modify the input, there will be a new entry generated with different inode.

2

I found the root cause now. Because i use vi command to modify the input file in ARM operation system. The vi command will change the inode with the input file.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.