Tanks for your answer and sorry for my unclear description.
Is filebeat detecting the wrong files to be renamed?
--yes, indeed no file was renamed, files are truncated from /cudetect/ to /cudetect/old/ by logrotate+crontab.
Some of my Filebeat Config:
Could it be that you hit an inode reuse issue?
--I'm not sure, I guess it is.
How toes the "rotation / renaming" happen?
--logrotate+crontab, source file in /cudetect/ and truncated file in /cudetect/old/
BTW, the wrong detecting of file-renaming occurs occasionally. I tried change the two kind of file to different path: pkgversion.log was truncated to /cudetect/pkg_old and upgradeexception.log was truncated to /cudetect/upd_old, after I modified filebeat.yml and restarted filebeat, this occured:
2016-09-02T08:00:09Z INFO Old file with new name found: /cudetect/old/upgradeexception.log-20160829.1472457541 is no /cudetect/pkg_rotate/pkgversion.log-20160902.1472803201
2016-09-02T08:00:09Z INFO Detected rename of a previously harvested file: **/cudetect/old/**upgradeexception.log-20160829.1472457541 -> /cudetect/pkg_rotate/pkgversion.log-20160902.1472803201