How to import a nginx log file(from first log, first line) with filebeat to elastic?

Elastic Stack Beats
1

Hi guys.
I configured a filebeat to import nginx log files to elastic.

# Module: nginx
# Docs: https://www.elastic.co/guide/en/beats/filebeat/7.16/filebeat-module-nginx.html

- module: nginx
  # Access logs
  access:
    enabled: true
    var.paths: ["/var/log/nginx/*access.log", "/var/log/nginx/*******.com-access.log"]

I tested this with a sample log file and it successfully imported the whole file.

But when I changed var.paths to nginx log files(a live log file with a size of 700MB), filebeat started to import the live logs, not from the beginning line of the log file. I need to import the whole file not just since filebeat started.

Does filebeat need extra configuration?

2

First try this

Go to the data directory see here

And clean it out This is where filebeat keep track of what it's loaded.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.