Hello,
I'm finding filebeat always reads log information from the beginning, so there are many duplicated log events. This issue occurred in filebeat 1.2.3 and 5.0.0-alpha. My configuration for filebeat 5.0.0-alpha is as below.
filebeat.prospectors:
- input_type: log
paths:- /root/test/test.log
output.file:
path: "/root/test"
filename: filebeat_output.log
- /root/test/test.log
other settings are kept as their default values.
I saw a response from @ruflin, it said, filebeat has problem with shared file system or the mounted disks. But I don't think I'm using the shared file system or mounted disk. Actually, what I'm using is a VM on cloud.
Does anyone help me on that? Thanks a lot.