How file beat handles the case if log files were replaced?

Elastic Stack Beats
1

Hi,

In my project, i have a requirement where we download logs from the devices on an hourly basis, unzip and push to elastic search. After every download, we are replacing the existing files. is file beat keep track of the last pushed pointer if the file got replaced? How do we achieve this with filebeat? Thanks for your help in advance!

Thx!

2

Filebeat tracks files based on node (at least on Linux), which means that as long as you append to an existing file it keeps track of what has been processed. If you however replace the file, it will appear as a new file and be parsed from the beginning.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.