So i have a similar issue outlined here and im pretty sure the problem is the same:
Our log writing process is custom and replaces the old log file entirely on update. The issue is when filebeat reads logs realtime and this occurs it is messing with the offset and clipping one or two lines. Im curious to know what filebeat uses on windows to identify files, is it also the inode?
I know its a problem that only occurs when reading realtime as it works flawlessly when ingesting older files.
Before I go through updating filebeat (and subsequent apps to keep them all playing nice), I have tried setting scan frequency to 5m. This works but not really... if the scan kicks off right as a new log file comes in i have the same issue. Is there a way to tell filebeat to ignore a file newer than 5 min (similar to ignore_older). That would fix my problem entirely.