How to handle log duplications on docker restart

Elastic Stack Beats
1

Hi,

Im trying to understand how to handle cases that filebeat docker is restarted and start collect same logs line again.

I guess that there is a way to mount filebeat offset information, I didn't see any information about that, maybe im searching the wrong keywords.

Edit: is that right thing to do to mount filebeat/data:/usr/share/filebeat/data in order to prevent duplicates?

Thanks

2

Yes, the data directory stores the registry file which has all the information about which files were already read. You should make sure that this is persisted and reused.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.