Thanks for a very detailed explanation. It has provided a good insight
This is how my file plugin is defined in the input of logstash.
type => "Audit"
path => "/mySample/Gway/*"
1.I have used glob pattern and under /mySample/Gway/ i have 10 files with .txt extension and these files will be updated every minute.
So, as you said 10 sincedb files will be created.Am i right? Once the log file is changed and Logstash reads , the existing sincedb file for that particular log will be overridden by Logstash?
2.The files under the mentioned directory will be rolled out daily.
For example:if i have /mySample/Gway/sampleData.txt file and by tomorrow it will be rolled out to /mySample/Gway/sampleData.txt.08012017 and new /mySample/Gway/sampleData.txt file will be created.
In the above scenario, as we are using glob pattern in the path, logstash will be polling to the previous day's file(/mySample/Gway/sampleData.txt.08012017) too ? and a new sincedb file will be created for the newly generated .txt file?
3.Is there any way to overcome with the INODE reuse issue with respect to Logstash?
Thanks in Advance