Hi Guys,
My config currently stands as;
filebeat:
prospectors:
-
paths:
- \\winserver\logs\single.log
input_type: log
fields:
sourceType: someservicename
tail_files: false
force_close_files: true
output:
elasticsearch:
enabled: false
hosts: ["elasticserver:9200"] #if this is deleted config is reported as invalid.
logstash:
enabled: true
hosts: ["1.1.1.1:5044"]
index: appname
The shares are backed by Windows.
I had read through to that network volume part and as I mentioned I can't run filebeat in prod just yet, Unfortunately our servers are still pets.
If "For example, changed file identifiers may result in Filebeat reading a log file from scratch again." this was happening I'd be happy. As my understanding on that is that if a file changes name it'll re-read from the beginning. As from my config i'm monitoring only a single file. When it hits 51mb it gets renamed and a new file is created with the same name. This is where filebeat stops working.
Results from -e -d '*' in next post because of size constraits.