How to tail_files once in filebeat

Elastic Stack Beats
1

How to invoke tail_files just once in filebeat? Whether or not the filebeat restart later.

The usage scenario is that I don't want to deal the exist files，and I just want to process new data

But if I only use tail_files, it may lost data when the filebeat restart.

Is filebeat support this scenario?

2

Hey @chenyahui and welcome to discuss :slight_smile:

filebeat run can be executed with the --once flags, that runs filebeat only until all the files have been read, then it stops, is this what you are looking for?

  --once    Run filebeat only once until all harvesters reach EOF
3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.