Filebeat, logstash handle logrotation quesiton/help

Elastic Stack Logstash
1

Hi,

Currently hitting an issues when I setup the filebeat -> logstash. Here is situation that I'm facing:

On filebeat (application) server, if the application log been rotated, (i.e app.log -> rotate to app.log.08172020.1), and then the same app.log been starting logging the logs again .

But on the logstash server side, it do captured the rotated logs (app.log.08172020.1), but the original log (app.log) are still getting input with the new logs which caused this original log (app.log) keep getting larger and larger.

So my question is is there a way that can setup on logstash side which truncate this original log (app.log) with start from 0 size again if that application log been rotated?

Thanks
Ling

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.