Log rotate introduced blank offset entry in registry

Elastic Stack Beats
1

Hi,

I noticed that when Filebeat detected a log rotation, it will create a new entry in registry. I discovered that the new entry will have blank offset. An example of the rotated log entry from my registry file (I expanded the JSON):

/home/mule/apps/mule-enterprise-standalone-3.7.3/logs/mule-app-HREventPublisher-1.4.0-v201605130543.log'.'2016-05-14":{
"source":"/home/mule/apps/mule-enterprise-standalone-3.7.3/logs/mule-app-SAPFixedAssetsToCoupaConsumer-1.0.2.log.2016-05-16",
"FileStateOS":{
"inode":712795,
"device":64778
}
}

If Filebeat were to restart it will then reprocess the file from the beginning.

Is this a known design?

Thanks for the advice.

2

This is a know issue and was fixed in the 1.2.3 release today: https://www.elastic.co/guide/en/beats/libbeat/current/release-notes-1.2.3.html

Thanks for reporting it.

3

Thanks ruflin! I have tested and confirmed that 1.2.3 fixed the missing offset of rotated log entry.

4

Good to hear. Thanks for testing.