I am running Filebeat 6.2.2 on a bunch of systems to forward to Logstash and facing an issue when one of them has a problem and reboots. After the reboot, Filebeat ingests all the logs and eats up system resources, while also increasing the load on Logstash.
How do I tell Filebeat to ignore all previous data, and start reading only from the current time after a reboot?
Here is my configuration:
- type: log