Ignore_older - Infrequently updated log file

Elastic Stack Beats
1

I just migrated to filebeats yesterday, am just starting to look into how it's performing.

Need some clarification on the ignore_older parameter. Does this mean if a file hasn't been updated in the defined time, it is no longer checked at all?

I have some error logs that may not get updated entries for hours or days. I am using the default of 10 mins.

Thanks

2

As soon as the file is update again, it will be picked up again next time the prospector is looking for new files. It depends on the scan_frequency setting on how fast this happens. Does this help?