Hi everybody , i need some help on filebeat harvesting a log file .
i have a problem and i need to know which logfile that already exist is harvesting by filebeat and how can i know that harvest is finished and how i can move that logfile from my server . i'm on low disks pace so i need to move the log file as fast as it can be moved to another server.
i'll be appreciate if any one can help.
Best regards
Milad
Hi,
it's an interesting question. There is a registry file that is updated from time to time, so I guess you can read its content to see which file is already processed? You can also assume that filebeat will be able to process log files "for sure" for an hour (safe timeout) and delete ones older than this period.
Hi dear mtojek, Thanks a lot for your reply.
I looked at the registry file but I couldn't understand when harvesting is finished! when a new log appeared it's mean that the previous one has ended and a new one started? i have more than 8Tb of log every day and it's making my ELK go slow if you have any suggestions on how can i handle this problem i would appreciate it.
Best regards
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.