Logstash always take file opened to read

Problem description
We have the following problem with file input:

  • Logstash read customer system logs
  • Customer system rotate file every 3 hours. it is working the following way:
    -- At first File is renamed
    -- At second new file is created
    -- If file can not be renamed system continue to write in it
  • But customer system could not rename file, because of it is always opened by logstash read session. And we cannot ask customer to change their rotation mechanism. Filebeat also cannot be used on customer environment:(

Is there a way to free file read session on few seconds by timer?
Or may be some other solutions?


  • Logstash 7.1.1
  • Logs are shared on our server by Samba
  • File input config is the following:
input {
    file {
        path => "/path/to/file"
        start_position => end
        codec => plain { charset => "ISO8859-1" }
filter {
    # some filters
output {
    # some output

I would be glad of any help or advise!

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.