Hello,
In order to check this theory, I changed my cron jobs to have the following behaviour:
At any moment, I have 3 prospectors whose the name is hh.yml; hh being the current hour, h-1 or h-2. For example, now I have 16.yml, 15.yml and 14.yml. My prospectors is like what I pasted above, only the paths change.
Expected behaviour:
At 4pm, when my cronjob is activated, I delete 13.yml, and create 16.yml. 14.yml and 15.yml remain the same and I restart filebeat. At 16:55, every registry entry for flows before 14h05 should have been cleaned (cleaned_inactive : 130m).
Furthermore, I should not have any duplicates, the registry is there to prevent it.
Actual behaviour : I still have a lot of duplicates.
Furthermore, in the registry, I still have entries for 14:20 or even 13:17. (Note : it's 16:48 right now so even 14:20 should have been cleaned from the registry).
I really struggle to see what's the issue there...
Regards,
Grégoire