We are using Filebeat 5.0.0 to parse log files. Log rotate on a daily basis (we are using Log4J's DailyRollingFileAppender to produce our log files). Log rotates every day at 00:00 and we get a truncated event everyday (not necessary first event of the day).
We've found this https://github.com/elastic/logstash/issues/5503 which seems to be solved in 5.0.0, but we did not find anything in FileBeat's release notes.
Filebeat's configuration looks like this :
- input_type: log
We think this could come from the fact that DailyRollingFileAppender does not seem to create a new file but to copy existing one. Would this be a good clue ? If true, is there some parameters we could set up to avoid this behaviour ?
Thank you for your help.