I've configured logstash to read all .system files from a specific directory and it works for new files. However after the file is read and indexed it won't re-read a file with the same file name even if I edit it or delete and replace it. I thought it might have to do with the sincedb however I s…

[image] mfisher: I thought it might have to do with the sincedb however I specify the path to /dev/null and it still has the same behavior. The sincedb_path controls where logstash persists the sincedb when it is stopped. The sincedb always exists for the time the file input running. I agree …

Discuss the Elastic Stack

Logstash File Input Won't Re-read Files

Elastic Stack Logstash

elasticforme (Sachin) February 3, 2020, 8:22pm 2

it has to do with inode.

https://discuss.elastic.co/t/file-updates-in-read-mode/202730

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.