Ignore_inactive is not working

Elastic Stack Beats
1 
#filebeat-8.0.0
filebeat.inputs:

* type: filestream
enabled: true
paths:
  * /var/log/*.log
ignore_inactive: since_last_start

I configure ignore_inactive: since_last_start,but filebeat still read at the beginning position of file.
2

hello @lingminzeng , welcome to the forum!

I configure ignore_inactive: since_last_start, but filebeat still read at the beginning position of file

this might be the expected behaviour, please see the docs:

Can you confirm the affected files read at the beginning position were sent to the output and acknowledge by filebeat? If not the offset position where to start from from processing the file will still be always 0

3

I can comfirm the affected files read at the begginning postion is sented to the output,but how can I see it is acknowledge by filebeat?

4

@lingminzeng , sorry for the late answer

if you enabled debug log you the following message will be logged:
PublishEvents: %d events have been published to elasticsearch in %v.

Are indeed the logs showing up in kibana?

There could be an error regarding updating the state of the registry for the harvested file, you should look in the logs for anything related to the registry and state

5

The problem has been solved，thanks！

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.