I configured a filebeat to import nginx log files to elastic.
# Module: nginx # Docs: https://www.elastic.co/guide/en/beats/filebeat/7.16/filebeat-module-nginx.html - module: nginx # Access logs access: enabled: true var.paths: ["/var/log/nginx/*access.log", "/var/log/nginx/*******.com-access.log"]
I tested this with a sample log file and it successfully imported the whole file.
But when I changed var.paths to nginx log files(a live log file with a size of 700MB), filebeat started to import the live logs, not from the beginning line of the log file. I need to import the whole file not just since filebeat started.
Does filebeat need extra configuration?