I am bit puzzled why Filebeat is sending all file data when only one line is added. I am expecting to behave like tail -f and send only one newly added file
How exactly are you adding the data? Filebeat expects the data to be appenddd so the inode of the file does not change. If you e.g. add data using an editor a new file with the same name but different inode is typically generated behind the scenes which would appear as a new file.
Thanks Christian. Yes, I was using editor and as you mention new inode must be generated. Appreciate your timely help.
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.