Hi,
I run ELK on Linux(CentOS7).
I know in Logstash we could add sincedb_path => "/dev/null" in
config/logstash.conf, so we could read same file again and again.
How to do this in filebeat?
The data that keeps track of what files have been loaded is contained in
./data/registry/filebeat you can delete the entire data directory (do not do in production) or go into the./data/registry/filebeat/data.json file and remove the entry you are interested in.
There is not a parameter to force reload / re-read of a log files like these is in logstash as far as I know.
Hi stephenb,
Thanks for your explanation.
It's really helpful to me.
Thank You! 
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.