Filebeat reads the complete log file from start

Elastic Stack Beats
1

Hello,
I am using filebeat version 5.6.0,in my log file location I am copying log files from remote machine.If the file already exist in my local directory i am replacing it with newer one after some time interval.
But if i see my filebeat is reading the file from the start instead of the last modified location.
Can you please help me understand is it the proper behavior and is there any way to resolve the issue

Thanks

2

Hi @Punit_Bangade,

By replacing the file Filebeat understands it's a new one, and sends it again. Is there any way you can update the existing file by appending the new lines?

3

Hello @exekias
Actually my application logs are on remote Solaris and i guess Filebeat don't support on Solaris,that's why I am copying those log fie from Solaris to local windows machine and then reading them.I am not sure what can be done in this scenario.
Can you please suggest something that will help us to overcome the situation

Thanks

4

Hi @Punit_Bangade,

If you are using a tool like rsync, you can ask it to append new lines to the existing files, that way Filebeat won't treat them as new, and will pick only the new lines. The way to do it when using rsync is passing the --append flag.

Best regards

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.