I am running Filebeat 6.2.2 on a bunch of systems to forward to Logstash and facing an issue when one of them has a problem and reboots. After the reboot, Filebeat ingests all the logs and eats up system resources, while also increasing the load on Logstash.
How do I tell Filebeat to ignore all previous data, and start reading only from the current time after a reboot?
Here is my configuration:
filebeat.prospectors: - type: log enabled: true paths: - /var/log/*.log close_inactive: 10m close_renamed: true close_timeout: 5m