Filebeat close_* clean_* params are confusing. Just want to wait 90s after rotation and then give up

Elastic Stack Beats
1

Howdy. I really don't understand what configuration I need for the docker input to just have filebeat do the following:

  1. tail new files (read from head)
  2. wait 90s after eof
  3. stop tailing file, remove from registry, pretend it never ever even ever once even ever existed for a single second.

We have a high volume of files being rotated in our GKE cluster and all i really want to is for the harvester for tail new files to the end, wait a timeout and then bail (removing from registry).

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.