Logstash file output plugin writing to the same file from multiple Logstash processes?!

[bjosve (Bjorn Svensson)]

Hi,

In the following post,

https://discuss.elastic.co/t/multiple-logstash-nodes-use-file-output-plugin-to-output-messages-to-one-file-in-a-shared-file-system/94275/9

@magnusbaeck writes,

If Logstash is opening the output file with O_APPEND (which it should) then all write() operations will be made at the end of the file even if multiple processes write to the file concurrently.

This does not seem to be true. We have a Kafka cluster with several Logstash (7.4.1) consumers (docker containers) that write to an NFS share. When multiple Logstash instances try to write to the same file, it becomes corrupt.

So my question is. Supports Logstash file output plugin writing to the same file from different Logstash processes or not?

Thanks.

[leandrojmp (Leandro Pereira)]

@bjosve

When multiple Logstash instances try to write to the same file, it becomes corrupt.

The NFS protocol does not support multiple writes to the same file, it can not guarantee that the writes will be atomic and that the file won't be corrupted.

From the nfs faq

A9. Why does opening files with O_APPEND on multiple clients cause the files to become corrupted?
A. The NFS protocol does not support atomic append writes, so append writes are never atomic on NFS for any platform.

[bjosve (Bjorn Svensson)]

Thank you. That explains a lot.