Can Filebeat be configured for handling high file creation rate (10 - 15 files per second) and for small file sizes of (500kb per file) version 7.17. My actual question is that what specific input type is preferable for this ? filestream input or anything else. I have read the documentation on this but I'm still a little confused. TIA
There is not much to choose, to read files you have 2 inputs, filestream and log, the log input is deprecated and the recommendation is to use the filestream input.
1 Like
One more question about file rotation. Considering my scenario, should I use a file rotation strategy at all and if I should, then create and rename strategy would be a better choice?