Filebeat. Read each time from the beginning of the file. How?

Elastic Stack Beats
1

Hi. Faced with such a need: I need to read the file every time from the beginning of the file and send events.
I have a file that is completely updated every 10 seconds, that is, the old content is overwritten with new content. If the new content is smaller (truncated is triggered) or equal to the old content (prospector.scanner.resend_on_touch: true), then there are no problems. But if the new content has become larger, then I can't get filebeat to read the file from the beginning, the clean_inactive setting doesn't help.

Can anyone tell me how to force filebeat read the contents of the file every time from the beginning of the file?

Tested on filebeat versions 7.16 and 8.6
My config:

filebeat.registry.flush: 1s
filebeat.config.modules.path: ${path.config}/modules.d/*.yml
logging.metrics.enabled: false
logging.level: debug

filebeat.inputs:

- type: filestream
  enabled: true
  id: health-check
  paths:
  - D:\testlog\status\*
  encoding: utf-8
  include_lines: ['^{"']
  prospector.scanner.check_interval: 4s
  close.reader.on_eof: true
  clean_inactive: 2s
  prospector.scanner.resend_on_touch: true
2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.