Logstash not seeing updates in logs

[Jozziej (Jos)]

When I use Logstash with the file plugin it reads the log till the point when Logstash discovered the file.
Any updates in the Logs are not tailed and showed

A little explanation from my side.
I use rsync to synchronize logs from 2 servers (Linux) to a local machine (Windows 7) which runs Logstash and Elasticsearch.

[Christian_Dahlqvist]

@Jozziej

Any updates in the Logs are not tailed and showed

Are you appending additional data to the log or modifying lines that may already have been parsed?

[Jozziej (Jos)]

Every additional data are new log lines with new timestamps

Below the message from the Logstash Logs

[2019-03-06T09:40:05,165][DEBUG][logstash.instrument.periodicpoller.jvm] collector name {:name=>"ConcurrentMarkSweep"}
[2019-03-06T09:40:08,208][DEBUG][logstash.instrument.periodicpoller.cgroup] One or more required cgroup files or directories not found: /proc/self/cgroup, /sys/fs/cgroup/cpuacct, /sys/fs/cgroup/cpu
[2019-03-06T09:40:09,725][DEBUG][logstash.pipeline ] Pushing flush onto pipeline {:pipeline_id=>"main", :thread=>"#<Thread:0x26e73c45 sleep>"}

[Jozziej (Jos)]

The problem is solved.

The issue is within rsync, it does not update the file itself.
When it is synchronizing it is making a duplicate of the existing file as a temp file and adds the extra data to replace the original file.

That's why I needed to restart Logstash to see the updated data