How do I tell logstash-forwarder to finish processing a log before rotation?


(Christophe Marie Duquesne) #1

Hi,

I am using logstash-forwarder to forward the content of a file. This file grows fast, and I need to rotate it often. To give you an idea, I trigger logrotate every 5 minutes. The condition for the rotation to actually happen is that the file must be bigger than 100M, and this condition is almost always satisfied.

I don't want to lose messages. I have a prerotate hook that stops the process generating the log and a postrotate hook that starts it again.

I also want to make sure that logstash-forwarder has time to process the log before the rotation. How can I guarantee that?

Cheers,
Christophe-Marie


(system) #2