Filebeat kubernetes reuse inode


i have got a kubernetes enviroment (v1.19.2) with some deployments.

Filebeat autodiscover properly "detects" log files, but after first log collect , filebeat are not harvest log files again (maybe after some time?)
Probably it is due to inode reuse on docker log file.
I'm using ext4 filesystem

Docker daemon.json

 max-files = 1, 
 max-size = 100M

Filebeat.yml properties:

        - type: kubernetes
          node: ${HOSTNAME}
          ignore_older: 1s
          scan_frequency : 1s
          clean_inactive: 3s

How I can deal with inode reuse?
Filebeat can deal with 40k log lines per second?
Docker can reach max file size in 10s
As output i'm using logstash

ELKF 7.12.0

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.