Logstash 6.5.3 inode reuse problem

Elastic Stack Logstash
1

Hi.
I use logback (file appender, time-based policy, hourly) and logstash send to kafka from logback result.
But when file is rolling, logstash miss some first lines.
I guess that inode in sincedb file is reuse.

Please tell me How I solve this problem? (ignore_older? sincedb_clean_after? filebeat?)

below (my logback config):

<file>logs/current.log</file>
<encoder>
    <pattern>%d{yyyyMMdd}\t%d{HHmmssSSS}\t%m%n</pattern>
</encoder>
<rollingPolicy class="ch.qos.logback.core.rolling.TimeBasedRollingPolicy">
    <fileNamePattern>logs/log_%d{yyyyMMdd,aux}/story_contents.%d{yyyyMMddHH}.log</fileNamePattern>
    <maxHistory>2</maxHistory>
</rollingPolicy>

below (my logstash config) :

input {
file {
type => "xxx"
path => [ "/path" ]
start_position => "beginning"
sincedb_write_interval => 1
}
}

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.