I´m new to ELK as well as to filebeat. Due to some restrictions we cannot install filebeat running on the source server(s), so we synchronize (rsync) all files regulary to the machine where filebeat is running.
After starting the sync, filebeat starts reading the whole file again - it´s not continuing at the latest offset.
How do I have to setup filebeat, so it remembers the last read position - and continues in processing only the new entries ?
Thanx for any hint,