How to start filebeat so that it stops after reading a file


I am currently trying to parse my old logfiles to elasticsearch. I have a bash script for this and everything would be running fine without the fact that after I have run a file through filebeat to logstash, the filebeat continues monitoring the file. My start command is :

sudo ./filebeat -e -c filebeat.yml -d "publish"

How do I need to modify the command so that filebeat reads the file and stops?

Hi @terminaattori,

Have a look to the --once command line parameter:, you will need to add close_eof setting to your inputs, as explained.

Best regards

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.