I noticed that when Filebeat detected a log rotation, it will create a new entry in registry. I discovered that the new entry will have blank offset. An example of the rotated log entry from my registry file (I expanded the JSON):
If Filebeat were to restart it will then reprocess the file from the beginning.
Is this a known design?
Thanks for the advice.