I'm trying to figure out an official answer as to how filebeat handles this hypothetical scenario, because I can't seem to find an answer in the documentation.
Presume we have an hourly log that filebeat reads and sends to Logstash. Then logstash goes down for a few hours, but filebeat hasn't finished reading that file so it waits until it reconnects to logstash
If ignore older is set to a low number, say 1 hour, after 1 hour, will filebeat let go of the handler for the initial file even though it hasn't finished sending the log to logstash yet? In that case, because nothing would be writing to that file, is the rest of the data on that file dropped?