Hello @SamehSaeed
I have checked on 9.2.0 and do not see any issues, at 02:24 i set the level from info to error & this is the last info message we see that log level is now error before this i see all the message in the log file info/warn/error :
{"log.level":"info","@timestamp":"2025-10-30T02:24:18.295Z","log.origin":{"function":"github.com/elastic/elastic-agent/internal/pkg/agent/application/actions/handlers.(*PolicyChangeHandler).applyLoggingConfig","file.name":"handlers/handler_action_policy_change.go","file.line":381},"message":"Setting fallback log level error from policy","log":{"source":"elastic-agent"},"ecs.version":"1.6.0"}
I see no logs from 2:24 to 2:39 , at 2:39 i set it to Warning and soon see Warn logs written in the file :
{"log.level":"warn","@timestamp":"2025-10-30T02:39:35.188Z","message":"2 files are too small to be ingested, files need to be at least 1024 in size for ingestion to start. To change this behaviour set 'prospector.scanner.fingerprint.length' and 'prospector.scanner.fingerprint.offset'. Enable debug logging to see all file names.","component":{"binary":"filebeat","dataset":"elastic_agent.filebeat","id":"filestream-monitoring","type":"filestream"},"log":{"source":"filestream-monitoring"},"service.name":"filebeat","filestream_id":"filestream-monitoring-agent","ecs.version":"1.6.0","log.logger":"input.scanner","log.origin":{"file.line":423,"file.name":"filestream/fswatch.go","function":"github.com/elastic/beats/v7/filebeat/input/filestream.(*fileScanner).GetFiles"},"ecs.version":"1.6.0"}
{"log.level":"warn","@timestamp":"2025-10-30T02:39:45.210Z","message":"2 files are too small to be ingested, files need to be at least 1024 in size for ingestion to start. To change this behaviour set 'prospector.scanner.fingerprint.length' and 'prospector.scanner.fingerprint.offset'. Enable debug logging to see all file names.","component":{"binary":"filebeat","dataset":"elastic_agent.filebeat","id":"filestream-monitoring","type":"filestream"},"log":{"source":"filestream-monitoring"},"filestream_id":"filestream-monitoring-agent","ecs.version":"1.6.0","log.logger":"input.scanner","log.origin":{"file.line":423,"file.name":"filestream/fswatch.go","function":"github.com/elastic/beats/v7/filebeat/input/filestream.(*fileScanner).GetFiles"},"service.name":"filebeat","ecs.version":"1.6.0"}
{"log.level":"warn","@timestamp":"2025-10-30T02:39:55.190Z","message":"2 files are too small to be ingested, files need to be at least 1024 in size for ingestion to start. To change this behaviour set 'prospector.scanner.fingerprint.length' and 'prospector.scanner.fingerprint.offset'. Enable debug logging to see all file names.","component":{"binary":"filebeat","dataset":"elastic_agent.filebeat","id":"filestream-monitoring","type":"filestream"},"log":{"source":"filestream-monitoring"},"log.origin":{"file.line":423,"file.name":"filestream/fswatch.go","function":"github.com/elastic/beats/v7/filebeat/input/filestream.(*fileScanner).GetFiles"},"service.name":"filebeat","filestream_id":"filestream-monitoring-agent","ecs.version":"1.6.0","log.logger":"input.scanner","ecs.version":"1.6.0"}
{"log.level":"warn","@timestamp":"2025-10-30T02:40:05.216Z","message":"2 files are too small to be ingested, files need to be at least 1024 in size for ingestion to start. To change this behaviour set 'prospector.scanner.fingerprint.length' and 'prospector.scanner.fingerprint.offset'. Enable debug logging to see all file names.","component":{"binary":"filebeat","dataset":"elastic_agent.filebeat","id":"filestream-monitoring","type":"filestream"},"log":{"source":"filestream-monitoring"},"service.name":"filebeat","filestream_id":"filestream-monitoring-agent","ecs.version":"1.6.0","log.logger":"input.scanner","log.origin":{"file.line":423,"file.name":"filestream/fswatch.go","function":"github.com/elastic/beats/v7/filebeat/input/filestream.(*fileScanner).GetFiles"},"ecs.version":"1.6.0"}
Thanks!!
