I have the worst logfile to try and parse. It is a complete XML document with a trailing closing tag. Each time the logfile is written to, new entries are being inserted before the closing tag. This is playing havoc with the offset tailing feature of filebeat, it is cutting off the start of the new xml log entries and not matching the multiline and logstash is not able to parse the xml.
Is there anything that can tell filebeat to re-read the last X bytes of a file or some other way to handle XML document based logfiles?
this is the basic structure of the file:
<logfile> <logentry> ... </logentry> <logentry> ... </logentry> </logfile>