How long filebeat harvester will be alive by default?

Elastic Stack Beats
1

HI,

I used filebeat to get my logs from one server to another , usually my logs generation is slow. I want to know how long the filebeat harvester will be alive ? Is there any possible case where the filebeat harvester will go dead if logs are not coming for long time.

THANKS

2

Unless you configure ignore_older or close_* it should monitor the file until all the data in the file has been completely read and the file is removed.

3

Thanks @andrewkroh

Is it includes until the file renamed too.
Because in my scenario in filebeat.yml i given path like this for input prospector /etc/today.log . So, the filebeat read the today.log until the file is read totally and at the end of the day the file will be get rolled to today.log-2017-06-14 and new log file will be created for today(i.e.today.log) . SO, I want to know whether the harvester will still running in the rolled over file or it get moved to new log file which generated today?

Thanks

4

You will need to ensure that Filebeat is configured to read /path/to/logs/today* if you want it to be able to continue following the log as it is rotated.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.