I used filebeat to get my logs from one server to another , usually my logs generation is slow. I want to know how long the filebeat harvester will be alive ? Is there any possible case where the filebeat harvester will go dead if logs are not coming for long time.
Unless you configure
close_* it should monitor the file until all the data in the file has been completely read and the file is removed.
Is it includes until the file renamed too.
Because in my scenario in filebeat.yml i given path like this for input prospector
/etc/today.log . So, the filebeat read the
today.log until the file is read totally and at the end of the day the file will be get rolled to
today.log-2017-06-14 and new log file will be created for today(i.e.today.log) . SO, I want to know whether the harvester will still running in the rolled over file or it get moved to new log file which generated today?
You will need to ensure that Filebeat is configured to read
/path/to/logs/today* if you want it to be able to continue following the log as it is rotated.
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.