Hi, i configured logstasth to monitor a file with below config
path => "/var/log/app1/xxxx.log"
type => "app1log"
when the file reaches certain size, it'll be renamed to xxxx-01.log by the application, and a new xxxx.log is created. I have two questions:
- obviously xxxx-01.log is not monitored, if logstash hasn't finished sending all contents before the file is renamed, what will happen to remaining loggings?
- if i change the path configuration to "/var/log/app1/xxxx*.log", the renamed file xxxx-01.log is also under monitor. Will logstash send all contents in xxxx-01.log regardless of how much it has sent before file rename? or it will only send the remaining, regardless of name change?