I was able to push a new CEL input to Filebeat v8.7.1 via puppet. When we launch filebeat v.8.7.1 I see this message pop up in the log:
{"log.level":"info","@timestamp":"2023-11-30T19:59:28.167Z","log.logger":"input.cel","log.origin":{"file.name":"cel/input.go","file.line":446},"message":"input stopped because context was cancelled with: context canceled","service.name":"filebeat","id":"6875877FA9FF2178","input_source":"/data/master/gpseg-1/pg_hba.conf","input_url":"/data/master/gpseg-1/pg_hba.conf","ecs.version":"1.6.0"}
Filebeat does not seem to recognize when my source file changes to send a record to my Elastic cluster.
How do I resolve this?
Marty Pacocha