Hey,
Logstash forwarder is re-harvesting a particular file for each log event. I have checked the .logstash-forwarder file and found that it has not updated the offset of this file which I did manually still it does not work. I have tried changing the permission of the .logstash-fowarder file that also has no effect.
LSF is deprecated and you are unlikely to get any support from anyone around it, please use filebeat instead 
© 2020. All Rights Reserved - Elasticsearch
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.