Hi @Dheeraj_Gupta, thanks for such a detailed report!
I can see two issues here:
- As you mentioned, inodes re being re-used by xfs, which will make Filebeat re-ingest the files. To overcome this, you will need to use a different
file_identity. In your casefingerprintseems to be the best option. - There seems to be a bug on how the offset is persisted/updated when a file truncation happens. I'll further investigate that.
You seem to be facing both at the same time, which only aggravate the situation.
Because the file truncation Filebeat is detecting is related to the inode re-use problem, changing the file identity will likely solve all the problems you reported here.