I have a log file which will be rsynced from another server(source server) using a different user ID (user 1). In the current sever(destination server) I'm running filebeat agen as a different user(user 2) User 2 and user 1 belonged to the same linux user group. The rsynced log file in destination server has read permission to the group, so filebeat user only has the read permission fpr the file. In this set up I have observed that filebeat agemt is reading the log file from the beginning for every rsync execution.
I didnt observe this behavior when I use owner(user1) of the log file and run the filebeat agent.
Any idea on this? Appreciate any thoughts or suggestions
Filebeat version - 7.4.0
Running on linux