Filebeat is resending all data

Elastic Stack Beats
1

I have one query regarding the data pushed by filebeat to logstash.

When I am opening and saving the log file, filebeat is resending all the data from the begining of the log. Is this the expected behaviour ? How can we overcome this?

When I am pushing one line without opening the file, it is working fine by sending the new data only. but resending all data when i am writting one line by opening the log file.

2

filebeat stores inode to identify files. If your editors saving strategy changes inode we have a hard time to tell wether the file has already been processed or not.

3

This was not the case in LSF. I am trying to migrate LSF to filebeat. Is there any way to overcome this issue in filebeat?

My configuration are at my previous post Migration of LSF to filebeat

4

filebeat code base is derived from LSF code-base. As I don't fully understand what's happening I will need some output to figure out what's going on on OS level.

Which operating system are you using? filebeat version?

Can you run filebeat in debug mode -v -d '*' plus check inodes with $ ls -i ? Compare inode with inode in registry file.

Please add all output.