Is a restart required to see new log files matching glob?


(Bryan) #1

If I use, e.g., '/var/logs/*.log' as a prospector path, and only 'a.log' and 'b.log' exist at startup, is a restart required to begin harvesting a new file 'c.log'?

IOW, will the system periodically re-run the search and start new harvesters?


(Magnus Bäck) #2

A restart is not necessary. The glob will be evaluated periodically.


(ruflin) #3

You can define the scan frequency here: https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-configuration-details.html#_scan_frequency


(Magnus Bäck) #4

You can define the scan frequency here: https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-configuration-details.html#_scan_frequency

The documentation isn't very clear. The parameter defines "how often these files should be checked for changes" which I read as "how often to stat the files to see if we should attempt to read from them again" rather than "how often to expand the filename globs".


(ruflin) #5

@magnusbaeck Good point. We will improve it: https://github.com/elastic/filebeat/issues/158 Thanks for the input.


(system) #6