Hi,
I am using logstash-forwarder to forward the content of a file. This file grows fast, and I need to rotate it often. To give you an idea, I trigger logrotate every 5 minutes. The condition for the rotation to actually happen is that the file must be bigger than 100M, and this condition is almost always satisfied.
I don't want to lose messages. I have a prerotate hook that stops the process generating the log and a postrotate hook that starts it again.
I also want to make sure that logstash-forwarder has time to process the log before the rotation. How can I guarantee that?
Cheers,
Christophe-Marie