Is it safe to move a log file?

[SolarBear (D)]

Hello everyone!

We've started using Filebeat very recently to monitor a certain log file and it's working all right. However I've been asked to move that file to a different location on disk as well as perform a daily log rotation.

Now after some searching I found out that Filebeat supports log rotation (and I've tried it out, it's working correctly), however I could not find any information about moving files around.

So say my file is currently /var/log/myfile.log and I need to move it to /home/lolwut/somename.log. Of course I would need to a) stop the Filebeat service, b) move the file to its new location and c) start the service. What I'm worried about is Filebeat thinking this is a new file (since it's not in the same directory or maybe even a different disk) and processing the whole file once again, creating some log duplication. Will Filebeat do what it does for log rotation, ie. watch the inode number of the file, even on a wholly different location on disk? What if it's on a different disk?

I only want to make sure the transition happens smoothly. Thank you for your help!

[tudor (Tudor Golubenco)]

If the file is moved (or renamed) it will keep the same inode, which is what Filebeat uses for identification, so duplicates shouldn't be created. Moving is actually not different from log rotation from Filebeat's point of view, so you should be good.

You don't need to stop and start Filebeat, and it's probably better if you don't since that would potentially increase the chances of hitting some corner case.

[ruflin]

One thing you should make sure is that both glob path definitions for the file are in the same prospector config.