I am facing a strange issue with Filebeat on Windows :
I use it to consume log files generated with log4net. These files are configures to rotate every day. Filebeat is only watching the current file.
Everything works well (new lines are forwarded to Logstash) until the first hours of the day after tomorrow.
Every day between midnight and 2 or 3 o'clock Filebeat stop seeing file updates.
I think it is not due to file rotation because the first lines of the new day are well forwarded to Logstasg.
But after a while (20 minutes to 2 hours) nothing is forwarded anymore.
And if I restart the windows service, all skipped events are well forwarded and everything goes well until the next day in the morning.
I am using the RC1 of Filebeat and in the logs I can see the the last event published and then these lines till the end :
2015-11-18T02:02:07+01:00 DBG Start next scan 2015-11-18T02:02:07+01:00 DBG scan path d:/logs/application.log 2015-11-18T02:02:07+01:00 DBG Check file for harvesting: d:/logs/application.log 2015-11-18T02:02:07+01:00 DBG Update existing file for harvesting: d:/logs/application.log 2015-11-18T02:02:07+01:00 DBG Not harvesting, file didn't change: d:/logs/application.log
There is no error in the log file.
I know that I do not have much info for troubleshoot this issue but if you have any idea about this issue or suggestions to collect more info, do not hesitate !
Some info about my Filebeat config :
filebeat: prospectors: - paths: - d:/logs/application.log encoding: iso-8859-1 input_type: log ignore_older: 5m registry_file: d:/filebeat/filebeat.application.registry spool_size: 1