Got filebeat monitoring various test JBoss instance, only quite some log files remains empty for long periodes and filebeat watcher still monitors such, just in case events do sometime get written to various logs.
But in the meantime filebeat logs quite a lot of warnings like these:
{"log.level":"warn","@timestamp":"2024-03-26T10:38:52.844+0100","log.logger":"file_watcher","log.origin":{"file.name":"filestream/fswatch.go","file.line":204},"message":"file \"<redacted log path>\" has no content yet, skipping","service.name":"filebeat","ecs.version":"1.6.0"}
{"log.level":"warn","@timestamp":"2024-03-26T10:38:52.844+0100","log.logger":"file_watcher","log.origin":{"file.name":"filestream/fswatch.go","file.line":204},"message":"file \"<redacted log path>\" has no content yet, skipping","service.name":"filebeat","ecs.version":"1.6.0"}
Have been trying to fool around with these settings to lower such warnings, but it seems to continue:
ignore_older: 25h
close.on_state_change.inactive: 25h
clean_inactive: 4h
scan_frequency: 30s
Hints appreciated for lowering warning log rate for long time inactive logs, but still picking up potential new events of, TIA!