How to start filebeat so that it stops after reading a file

Elastic Stack Beats
1

Hey!

I am currently trying to parse my old logfiles to elasticsearch. I have a bash script for this and everything would be running fine without the fact that after I have run a file through filebeat to logstash, the filebeat continues monitoring the file. My start command is :

sudo ./filebeat -e -c filebeat.yml -d "publish"

How do I need to modify the command so that filebeat reads the file and stops?

2

Hi @terminaattori,

Have a look to the --once command line parameter: https://www.elastic.co/guide/en/beats/filebeat/current/command-line-options.html, you will need to add close_eof setting to your inputs, as explained.

Best regards