I am removing it before start.
If I am not removing it, so it does not start to run on the log file, since it has already read it.
I did not really checked the content of it, just delete it each time before each run.
Ori
Can you check if you still find this error messages in your logs, and if yes check the content of the file to see if the content is up-to-date? Also interesting to know how often you see the message.
Will try to.
Ori
Just saw your comment in: Filebeat 5.0 with multiline, split event data to two events
Does that mean you see less CPU usage under Linux, means this could be a Windows specific issue?
Hi Ruflin,
I did saw less CPU usage under linux, but it was running against a Dev Server, which has much much less activity than on Prod Servers.
Since I am making changes to use the ingest node directly and not go through Logstash, currently for 22 different log types, I am having a dedicated filebeat process to read the logs.
So it is not entirely the same configuration......
It is hard to tell......
Ori
In case you see some differences in the future, that would be interesting to hear.
This topic was automatically closed after 21 days. New replies are no longer allowed.