Filebeat version: 5.1.2
OS: Debian Jessie
I am trying to set up an IIS log dashboard for the company i work for.
So i set up a Filebeat>Logstash>Elasticsearch>Grafana server.
For a few days i thought everything was working as intended. I got pretty graphs, but after actually analyzing the data and logs i found out the data is duplicating. At the start of each day or hour (depending on what i set the IIS log schedule on) i get correct data, but after 20 minutes the data duplicates.at that point i get the following message in my logs.
2017-02-09T15:20:12+01:00 INFO File was truncated. Begin reading file from offset 0: /
This repeats every 20-30 minutes.
Everything i tried so far is comming up short.