Filebeats to read locked file

[Parthgandhi]

Hi,
I have an application which continuously writes to a log file and locks it while it is writing the data. I need to use filebeats to get the logs from the file to ElasticSearch in Real Time. Can filebeat ship such data from such a locked file? Also does filebeat lock the files while collecting and shipping the data.
Thanks,
Parth

[kvch (Noémi Ványi)]

Filebeat does not lock files while reading.
Do you run your application on UNIX or Windows? Because on UNIX file locks between processes are advisory. So in that case FB can read from those locked files.

[Parthgandhi]

The application is running on Windows.

[andrewkroh]

Filebeat will only be able to read from the file if the application writing to it has allowed shared read access to file.

Filebeat locking files

Filebeat does not lock files. It opens the file for reading only. And it specifies that the file can be read, written, and deleted by other applications while it has it open. It sounds like the thing that is trying to access the file is requesting exclusive access which it cannot get. It needs to allow other applications to read the file (FILE_SHARE_READ) when it opens the file.