My FileBeat is losing 10 seconds of approximately logs. Obviously the problem is in the rotation of the files, but I can not find the correct option so that these logs are not lost.
The Rotation of Logs performs Log4J:
655947 -rw-r--r-- 1 user group 21M Aug 20 09:34 /opt/weblogic/logs/app/app-150.log 655948 -rw-r--r-- 1 user group 20M Aug 20 18:19 /opt/weblogic/logs/app/app.log ----- rotated ----- 655948 -rw-r--r-- 1 user group 21M Aug 20 09:34 /opt/weblogic/logs/app/app-150.log 655949 -rw-r--r-- 1 user group 20M Aug 20 18:19 /opt/weblogic/logs/app/app.log
By listing the Inodes, when rotating the log, the inode is maintained for the rotated log (150) so I understand that FileBeat should read it until the end but it does not happen.
In the log of FileBeat it is indicated that it was truncated and starts again to read the file without finishing reading the 150. Is this my basic configuration, any idea?
- type: log enabled: true fields: log: "app" server: "server4" paths: - /opt/weblogic/logs/app/app.log
Should I use any of these options: scan_frecuency, close_inactive, harvester_buffer_size ??
or maybe use the path of the log and the rotated, like:
paths: - /opt/weblogic/logs/app/app-150.log - /opt/weblogic/logs/app/app.log
Thanks for the help!