I think you are looking for ignore_older option which must be used in combination with clean_inactive
. This obviously only works, if you really now the predefined period when files will be overwritten. close_eof
could also be helpful in your case if the file is only written once.
The problem in the above case seems to be, that the new file is not necessarly smaller then the old file. Filebeat can detect truncated files to start reading from scratch, but as with log files assumed, new file is smaller then old file.