Filebeat: anything to know about rotating logfiles?

Elastic Stack Beats
1

Hi,

I am monitoring a jboss application with a lot of logfiles. Log4j is taking care of log rotating. Files are rotated when a given size is reached and a suffix is added.

In the past I always told filebeat to use *.log, so *.log.1 is out of scope.

  1. Is my unerstanding correct, that filebeat will read the last lines of log.1, if it was rotated before being read by filebeat, because the inode id of the logfile remains when the file is rotated? So filebeat will read *.log and rotated *.log.1?
  2. If I would set filebeat to look on log, would it have in the end the same effect as *.log ? Because no new lines are ever added to already rotated logs.
  3. How is it on windows? Is filebeat also using some identifier which lives longer than a file renaming?

I just want to make sure, that I did not understood anything wrong and that we may lose or duplicate log lines on production.

Thanks, Andreas

2

Please refer Handeling log rotation

3

thanks, that thread answered first to questions.

Is it the same on windows, or does filebeat miss an equivalent to linux' inodes?

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.