Is it possible for filebeat to send the entire contents of the log file to index every specific time interval? I want to save the state of a specific process to a file, overwrite the file each time and not keep historical data in this file.
Can you just save each state file as a new name (include a timestamp?) And configure Filebeat with a wildcard?
I don't want to keep additional log files on the system. Saving the state to new files every time causes a problem that I wanted to avoid.
I currently have one log file. Each time I send the process status with a new timestamp to the log file. Filebeat doesn't read this one line as updated. I think there is some maker in the filebeat configuration and if I don't reset it every time, it won't start reading the file from the beginning, but will wait until something is added on subsequent lines.
Filebeat tails logs, so it needs a new line to read an event, if you have just one single line in the file it may not read it.
You could add a single empty line to your file to solve this.
Also, filebeat keeps track of what it already read, if you are writing to the same file then you need to make sure that the inode of the file will change (delete the olde one and write a new one), or filebeat also may not read it.
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.