Hello,
How often does the registry file get updated? is it periodic (every few minutes)? or is updated after each log line is acknowledged?
Thanks
The registrar file is written every time events are sent out and acknowledged by Logstash or Elasticsearch. How often events are sent out depends on spooler config idle_timeout and spool_size: https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-configuration-details.html#_spool_size