Logstash-forwarder missing lines after log rotate

Elastic Stack Logstash
1

Hello,

We have problems with the logstash-forwarder after the log rotate of massages & secure we are missing the first couple of messages. At least the first one and then sometimes the next 2-5. After that there isn't a message lost anymore.

We use version 0.3.1 is this fixed in 0.4.0?

Any help appreciated!

Here the logstash-forwarder config:
cat /etc/logstash-forwarder.conf
{
"network": {
"servers": [
"xxx:xxx",
"xxx:xxx"
],
"timeout": 15,
"ssl ca": "/etc/pki/tls/certs/logstash-forwarder.crt"
},
"files": [
{
"paths": [
"/var/log/messages",
"/var/log/secure"
],
"fields": {
"type": "syslog"
}
},
{
"paths": [
"/var/log/genericlog/*"
],
"fields": {
"type": "generic"
}
}
]
}

Cheers,
Chris

2

Log writers might not realize immediately that the file they're writing to has been rotated. Does it work better if you let logstash-forwarder monitor the first-order rotated files, i.e. /var/log/messages.1 and /var/log/secure.1?

3

Hello,

tried it, does not change anything.