Lost logs with logrotate

Elastic Stack Logstash
1

I have a logstash process that writes a log file ( syslog.log) and a logstash process that reads the log file.
When logrotate starts, it changes the filename into syslog-[date].log and some logs that aren't read yet from second logstash process are lost . The conf file of second logstash process is like this

input{
  file{
    type => "syslog"
    codec => "json"
    path => "/var/log/syslog.log"
    start_position => "beginning"
    sincedb_path => "/var/log/logstash/sincedb/.sincedb_syslog"
   }
....

I tried to increase batch and workers of second logstash process but I lost anyway logs.
Any suggest?

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.