If filebeat finish to harvest is it mean that logstash finished to process?

Elastic Stack Beats
1

I can see from the "offset" field in the registry file of filebeat that it finish to harvest some file.
Is it mean that logstash finish to process the file and send it to elasticsearch?

2

Can someone please confirm or deny it?

3

I think you can deduce the answer from this doc: https://www.elastic.co/guide/en/beats/filebeat/current/how-filebeat-works.html#at-least-once-delivery

4

Thanks Marcin. From this doc I understand that in general the answer is yes, the offset confirms the end of the processing. Of course logstash can take some more millisecond to finish its parsing but in general this is a good sign that the parsing finished.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.