Limiting log 'noise' due inactive log files

Got filebeat monitoring various test JBoss instance, only quite some log files remains empty for long periodes and filebeat watcher still monitors such, just in case events do sometime get written to various logs.

But in the meantime filebeat logs quite a lot of warnings like these:

{"log.level":"warn","@timestamp":"2024-03-26T10:38:52.844+0100","log.logger":"file_watcher","log.origin":{"file.name":"filestream/fswatch.go","file.line":204},"message":"file \"<redacted log path>\" has no content yet, skipping","service.name":"filebeat","ecs.version":"1.6.0"}
{"log.level":"warn","@timestamp":"2024-03-26T10:38:52.844+0100","log.logger":"file_watcher","log.origin":{"file.name":"filestream/fswatch.go","file.line":204},"message":"file \"<redacted log path>\" has no content yet, skipping","service.name":"filebeat","ecs.version":"1.6.0"}

Have been trying to fool around with these settings to lower such warnings, but it seems to continue:

  ignore_older: 25h
  close.on_state_change.inactive: 25h
  clean_inactive: 4h
  scan_frequency: 30s

Hints appreciated for lowering warning log rate for long time inactive logs, but still picking up potential new events of, TIA!

We observe the same issue and have customers complaining about it. We deploy on Red Hat OpenShift using the latest OpenShift and Elastic Operator version.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.