Filebeat implementation questions

Elastic Stack Beats
1

Hello every one,

I've been using Filebeat for the past month and half, and it's working like a charm. I've just some questions about some Filebeat (v 6.x) implementation details :

  • In the FAQ, it's said that it's not recommended to use Filebeat with network volumes especialy those backed with Windows. And that, there is a case when changed file identifiers can cause Filebeat to reread the file from scratch. My question is this, what are these identifiers? Or more generally how does Filebeat identifies files in Windows?
  • How does Filebeat handle concurrent access to files that are being harvested?

Thanks in advance

2

There are 3 identifiers used on windows: idxhi, idxlo, vol.

For the concurrent access: Can you elaborate a bit more on what you are looking for here?

1 Like
3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.