Hello.
Im trying to ship logs via filebeat 8.1.2
I have an app that generate text log, but in strange manner:
After first event log file look like this:
Line 1\n
(space_symgol_1)(space_symgol_2)...(space_symgol_1_000_000)
After next event it look like this:
Line 1\n
Line 2 (100 symbols)\n
(space_symgol_1)(space_symgol_2)...(space_symgol_999_900)
In other words app reserve space and use it for inserting new data.
I see this spaces in notepad. Under the hood, i guess, it is amount of NULL.
This behavior causes harvester to stop reading new lines. I get lines only till filebeat start time.
I’ve tried using close_timeout: 30s. It almost worked, but at midnight app delete these spaces and filebeat read the file again, and logs are duplicated.
Is there a way to harvest only till last but one line?
Any help will be appreciated.