I am new one here. I have got a question regarding to 'file input' plugin and sincedb file. Let me try to describe situation:
Traces are coming all the time to the specific log file. Generally Logstash is turned on,
but sometimes I would like to turn it off. In this case I would like to skip traces, I do not need to take care of them. When I turn Logstash on again I wish to process only new incoming traces.
So my question is: how to handle logs comming only when Logstash is turned on?
Should I manipulate/update sincedb file? Is it the only proper solution?
Maybe there is certain flag to deal with it in this way?
Please correct me if I am wrong, but it seems that default value of start_position ('end') does not fit in this case.
I really appreciate. Any suggestions are welcomed.