I've configured logstash to read all .system files from a specific directory and it works for new files.
However after the file is read and indexed it won't re-read a file with the same file name even if I edit it or delete and replace it.
I thought it might have to do with the sincedb however I specify the path to /dev/null and it still has the same behavior.
My input section for logstash.
input {
file {
mode => "read"
path => ["/etc/logstash/config/sysinfo/*.system"]
start_position => "beginning"
sincedb_path => ["/dev/null"]
type => "system-info"
}
}