How does filebeat keep track of what line it has read?

Elastic Stack Beats
1

If I have a log file that are x MB long, and there is a new log entry.
How does FIlebeat know where it should start to read again?
Does it need to retrieve the entire file, or does it open the file from its last known line?

2

This topic can answer your questions.

https://www.elastic.co/guide/en/beats/filebeat/6.0/how-filebeat-works.html#_how_does_filebeat_keep_the_state_of_files

3

I have already read that site arkady_renko. But I didn't understand it.

4

Filebeat stores the last read offset and when opening it will directly jump to this offset.

5

But does it open the entire file? If the file is located at server B, but filebeat is located at server A. Does it then have to retrieve the entire file ?

6

In general we don't recommend to read from a remote file system.

What exactly happens I think does more depend on the OS and the Filesystem then Filebeat itself. Filebeat calls seek on the file handler and requests to start reading from that offset.

7

Thanks ruflin.

8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.