How to import a nginx log file(from first log, first line) with filebeat to elastic?

Hi guys.
I configured a filebeat to import nginx log files to elastic.

# Module: nginx
# Docs:

- module: nginx
  # Access logs
    enabled: true
    var.paths: ["/var/log/nginx/*access.log", "/var/log/nginx/*******.com-access.log"]

I tested this with a sample log file and it successfully imported the whole file.

But when I changed var.paths to nginx log files(a live log file with a size of 700MB), filebeat started to import the live logs, not from the beginning line of the log file. I need to import the whole file not just since filebeat started.

Does filebeat need extra configuration?

First try this

Go to the data directory see here

And clean it out This is where filebeat keep track of what it's loaded.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.