Filebeat processing file the rsynced file always from the beginning

Elastic Stack Beats
1

Hi,

I have a log file which will be rsynced from another server(source server) using a different user ID (user 1). In the current sever(destination server) I'm running filebeat agen as a different user(user 2) User 2 and user 1 belonged to the same linux user group. The rsynced log file in destination server has read permission to the group, so filebeat user only has the read permission fpr the file. In this set up I have observed that filebeat agemt is reading the log file from the beginning for every rsync execution.

I didnt observe this behavior when I use owner(user1) of the log file and run the filebeat agent.

Any idea on this? Appreciate any thoughts or suggestions

Filebeat version - 7.4.0
Running on linux

Thanks

2

Any thoughts on this?

Thanks in advance

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.