Logstash is reading whole log file every time it updates


Every time a new log line is added to my log file, logstash is re-parsing my whole log file and sending it to elasticsearch. I have no idea why this is happening? Any ideas?

I have not set

sincedb_path => "/dev/null"

My logfile is being sent via filebeat to logstash.


Exactly how is data being added to the log file? Make sure it is appended without changing the inode. If you are adding data e.g. through an editor a new file with the same name is typically generated for each save.


Thanks for the reply. It seemed as though it was permission issue with the log file. Changing to read/write permissions seems to fix the issue.


This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.