Hi
I'm using ELK-6.3.1 now I have a problem: after the filebeat server unexpectedly stopped, filebeat did not start after restarting the server, and after restarting filebeat, I have accumulated a lot of logs. How do I collect these logs?
Please advise. Thank you.
How the server generation log is passed to logstash after startup after filebeat unexpectedly stops?
After Filebeat is restarted it continues reading logs from where it has stopped. Filebeat considers an event successfully sent if the output returns an ACK after batch (which includes that event) sent and processed. Then the state is written to a registry file. So Filebeat knows where it left off previously, if it stops unexpectedly.
What is the problem you are seeing? Does filebeat forward logs after restart?
Hi
Fiirst of all, thank you very much for answering my question. You explained very clearly about the question I mentioned! And now that's a tricky problemhttps://discuss.elastic.co/t/filebeat-collects-logs-prior-to-deployment-of-elk/144446?u=ss.z
Thank you. I wish you well in your work.
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.