Filebeat is not reading updated logfile

Hello, we are using ELK stack and we are trying to read a .log file and pass that log information to our elasticsearch so we can manipulate it on Kibana. To do that we decided to use Filebeat, but we encountered an inconsistency, whenever a new line is added to our .log file that is being listened by filebeat, it's not being updated in our logstash server,

We have logging on debug level and we noticed that when the log file is updated, a "Flushed Event" is fired, but it is always equal to 0, as the example below:

Also, here is the filebeat.yml content:

Can you share some details on how you update the log file and the version of filebeat?

Sure =)

we are updating the file manually, inserting lines like this:

Filebeat version is 1.2.3

Thank you in advance for helping.

This could be an issue with the editor. Can you try:

echo 'your-content-here' >> logfile.txt

Check if that brings the expected behaviour.

1 Like

Hey, @ruflin, thank you very much!

It worked fine! =)


The issue is that some editors do not update the modified time before the file is closed ...

1 Like

This topic was automatically closed after 21 days. New replies are no longer allowed.