Seeing a disproportionate number of these messages " INFO File was truncated. Begin reading file from offset 0:" in /var/log/filebeats . Curiously complete files are being processed needlessly again.
Log ingestion is happening on a netapp cifs share which is mounted on a Linux server.
Is it possible I could be seeing an inode reuse issue on the share, I know it can't be cache related as this has been turned off on the linux host and the netap device.
Can anyone shed any light and what effect if any the close_* config options might have on this issue?