However, there is something happening to those log files that is not expected by you and me, which leads Fielbeat to behave in a way we do not expect.
Exactly! 
I've managed to create a truncate with an artificial log. This is the setup:
This script creates a logfile:
i=0
while true; do
let i++
for j in `eval echo {1..10}`; do
echo "$(date) - $i - $j" >> /tmp/test-filebeat/test.log
done
sleep 300
done
A second script rotates the log:
#!/bin/bash
LOG=/tmp/test-filebeat/test.log
while true; do
SIZE=$(stat -c%s "${LOG}")
if [ ${SIZE} -gt 2048 ]; then
sleep 3
mv -f ${LOG} ${LOG}.1
touch ${LOG}
fi
sleep 4
done
The filebeat configuration:
logging:
level: info
files:
keepfiles: 2
metrics:
enabled: false
output.logstash:
hosts: ["XXX:5046", "XXX.lvm.de:5046", "XXX.lvm.de:5046"]
loadbalance: true
ssl.verification_mode: full
path:
data: /tmp/test-filebeat/data
logs: /tmp/test-filebeat/log
config : /etc/filebeat
filebeat.inputs:
- enabled: true
id: test.log
type: filestream
encoding: plain
paths:
- /tmp/test-filebeat/test.log
prospector.scanner.check_interval: 2s
If you want to read the timestamps in the registry, you can use this application: GitHub - belimawr/registry-decoder: Filebeat registry decoder/pretty-printer.
Thanks for this tool!
I've just used it and I'm sorry to bother you again - But I see that some timestampe seems to be no correct like the updated in the third entry?
$ ./registry-decoder log.json | grep test.log
{"k":"filestream::test.log::native::1305-64790","v":{"cursor":{"offset":1604},"meta":{"source":"/tmp/test-filebeat/test.log","identifier_name":"native"},"ttl":1800000000000,"updated":"2023-06-23T18:10:25.568418028+02:00"}}
{"k":"filestream::test.log::native::1305-64790","v":{"cursor":{"offset":2406},"meta":{"source":"/tmp/test-filebeat/test.log","identifier_name":"native"},"ttl":1800000000000,"updated":"2023-06-23T18:20:25.568849086+02:00"}}
{"k":"filestream::test.log::native::1305-64790","v":{"cursor":{"offset":2406},"meta":{"source":"/tmp/test-filebeat/test.log","identifier_name":"native"},"ttl":0,"updated":"2023-06-23T18:20:25.568849086+02:00"}}
{"k":"filestream::test.log::native::1302-64790","v":{"cursor":null,"meta":{"source":"/tmp/test-filebeat/test.log","identifier_name":"native"},"ttl":0,"updated":"0000-12-31T23:55:44Z"}}
{"k":"filestream::test.log::native::1302-64790","v":{"cursor":null,"meta":{"source":"/tmp/test-filebeat/test.log","identifier_name":"native"},"ttl":1800000000000,"updated":"2023-06-23T18:20:27.568606412+02:00"}}
...
The timestamp in the registrys raw data seem sto be corrupt?
cat log.json | grep test.log
{"k":"filestream::test.log::native::1305-64790","v":{"ttl":1800000000000,"updated":[515964493548,1687536625],"cursor":{"offset":1604},"meta":{"source":"/tmp/test-filebeat/test.log","identifier_name":"native"}}}
{"k":"filestream::test.log::native::1305-64790","v":{"ttl":1800000000000,"updated":[515964924606,1687537225],"cursor":{"offset":2406},"meta":{"source":"/tmp/test-filebeat/test.log","identifier_name":"native"}}}
{"k":"filestream::test.log::native::1305-64790","v":{"ttl":0,"updated":[515964924606,1687537225],"cursor":{"offset":2406},"meta":{"identifier_name":"native","source":"/tmp/test-filebeat/test.log"}}}
{"k":"filestream::test.log::native::1302-64790","v":{"ttl":0,"updated":[281470681743360,18446744011573954816],"cursor":null,"meta":{"source":"/tmp/test-filebeat/test.log","identifier_name":"native"}}}
{"k":"filestream::test.log::native::1302-64790","v":{"meta":{"source":"/tmp/test-filebeat/test.log","identifier_name":"native"},"ttl":1800000000000,"updated":[515964681932,1687537227],"cursor":null}}
...
