@ogauchard Yes, the problem is that the next change is detected but the file pointer is potentially set to the end. Currently ignore_older mixes two different functionalities into one: https://github.com/elastic/filebeat/issues/181 Feel free to also comment here what your expectations would be.
We still have to think again through the different use cases etc. and what should happen in which case, but at the moment the best potential solution is to set ignore_older to a much higher value.