FileBeat updatable log

Elastic Stack Beats
1

Need help configuring filebit ...
One of my applications writes rotated logs to a file with a specified number of lines.
If the file contains only 3 lines, then the log at the first moment of time will look like this:

1111
2222
3333

In the second time period, the next record will take the place of the first one and the log will look like this:

4444
2222
3333

At the third moment in time, the log will look like this

4444
5555
3333

And so on...

The original file name remains unchanged, only the modification time of the file changes.
The problem is that after reading this file for the first time, the filebit no longer monitors it and no updated data is received.
Here is my current FileBeat input configuration:

filebeat.inputs:
 - type: log
   tags: ["myapp"]
   enabled: true
   paths:
    - C:\myapplogs\1.log

Can anyone please help how to properly configure the filebit to collect such a file?

2

Unfortunately, this log rotation method is not supported by Filebeat at the moment.
The only workaround that comes to my mind is that you could delete manually the entry about the file in the registry after every logrotation. Does that work for you?

3

thanks,
it doesn't work for me !
I'll try to make sending logs by a custom script...

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.