Missing event - file input plugin / NFS

[guyboertje]

I suggest filebeat because it the recommended tech now days. The LS file input has not had much attention in a long time. Both LS and Filebeat are OK to read a NFS mount - there some things to be aware of.

Using logstash File Input to monitor files on a network share

Reading files from network shares is OK with Logstash's file input. One thing to be aware of: Some network filesystems (nfs) have aggressive client-side caching that cause Logstash to be lied to about the state of the file - this caching prevents Logstash from detecting new changes in files on those nfs mounts. For windows, Samba/CIFS I think, I can't recall anyone having trouble with this, so it should work fine. Of course, let us know if you find otherwise

Also Jordan wrote this is in an internal memo:

My still-unclear understanding of this problem is follows: Reading and writing from the same file with two different NFS clients is not supported by NFS itself.

Can you put filebeat on remote machine?