If filebeat finish to harvest is it mean that logstash finished to process?

[111320 (Refael Jan)]

I can see from the "offset" field in the registry file of filebeat that it finish to harvest some file.
Is it mean that logstash finish to process the file and send it to elasticsearch?

[111320 (Refael Jan)]

Can someone please confirm or deny it?

[mtojek (Marcin Tojek)]

I think you can deduce the answer from this doc: https://www.elastic.co/guide/en/beats/filebeat/current/how-filebeat-works.html#at-least-once-delivery

[111320 (Refael Jan)]

Thanks Marcin. From this doc I understand that in general the answer is yes, the offset confirms the end of the processing. Of course logstash can take some more millisecond to finish its parsing but in general this is a good sign that the parsing finished.