How To Make Logstash Read Entire File Every Time Which is from File Beat?


(Yenike Raghu Ram) #1

input {
beats {
port => 5048
}
}

output {
stdout { codec => rubydebug }
file
{
codec => line {
format => "%{[message]}"
}
path => "C:/Program Files/logstash-6.2.3/testPractice/LogsCollected/DebugLog09May2018/OneTwo.html}
}

For first time OneTwo.html is read its fine , from second time when OneTwo.html changes
Content is appended at bottom and that too not properly


#2

Filebeat is designed to tail a log file and read new lines as they are appended to it. It is not designed to do what you are asking for.


(Yenike Raghu Ram) #3

Yeah got it but in this case
say like in original file I ve 2 lines
a
b

We've modified one line say 'a'
now output file is like

a -- original data
b
a -- modified data
b

I am expecting it to be like log file to have only two lines as with my original log file which has two lines , but with modified data in one of lines

a -- modified data
b


#4

I cannot think of a way to do that with beats and logstash.


(Yenike Raghu Ram) #5

Is there a way to achieve this by having input as log stash in place of file beats (or) any other alternative?


#6

It sounds like you are trying to do remote file replication. logstash is not the right tool.


(Yenike Raghu Ram) #7

Can you please suggest any tool for doing remote file replication for MAC OSX (or) Windows OS, Thanks in advance


#8

rsync.


(system) #9

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.