Logstash behaviour when deleting and adding the same file

Elastic Stack Logstash
1

Hello, I am not sure about Logstash's behaviour when faced with the following example:

Suppose you have a file with > 100 lines of input. Logstash indexes this and the file is removed. What will logstash do if the same file name is created again, now with new content? The time period between the deletion and the creation could be from minutes to days.

Thanks in advance.

2

It will be treated as a new file as it will have a different inode.

3

Thank you for the quick reply! I do have a follow-up question on that.

What happens if you clean out the file? Will Logstash reset it's EOF and parse from the beginning again?

Example for clarification:
I fill up a file with 100mb of text. Then in my code I clear out the file without removing it. What will Logstash do then?

4

If the inode stays the same it should continue reading from the offset it previously reached.

5

If you are on a filesystem that uses inode generation numbers then as Christian says, the inode will certainly be different. However, there are filesystems where a new file will just re-use the next available inode number, and then a file input will think it is the same file and expect to continue reading it from the last offset it read from.

6

Thank you for the answers.

7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.