It will work, as long as your file gets updated frequently enough (faster then every 5 minutes).
@ruflin Do you think the issue is related to file close due to ignore_older configuration ? This is not a problem at other times of the day. The file is closed because it is not updated during 5 minutes but the next change is well detected.
@ogauchard Yes, the problem is that the next change is detected but the file pointer is potentially set to the end. Currently ignore_older mixes two different functionalities into one: https://github.com/elastic/filebeat/issues/181 Feel free to also comment here what your expectations would be.
We still have to think again through the different use cases etc. and what should happen in which case, but at the moment the best potential solution is to set ignore_older to a much higher value.
@ruflin I understand. So I change the ignore_older to a higher value and give you feedback tomorrow.
@ruflin Another day in paradise ! Everything is fine this morning. Just wondering whether I update Filebeat with the GA version and restart all the stuff or leave it working a few more days to see what happens. What do you think ?
@ogauchard I recommend to update to GA. GA is almost identical to the version you are using now. Using the GA will make it also on our side easier to track down a problem in case there is one as we know exactly the version in use.
@ruflin Still running well till wednesday with filebeat GA and other components in latest version. The problem seems to be fixed. Thanks for your support !
Hi,
will you help me on my topic?