"Overwritten" files & logstash

[mitabrev]

Hi guys,

Got one question.
I would like to create bash scripts from my elastic server to harvest log files from remote directories. It would be probably very often, that one log file would be overwritten with the same file during the script automation.

What will logstash/sincedb do?
-filename <- remains the same
-filesize <- remains the same
-filecontent <-remains the same

only change would be to last modification time on the local server.

Will logstash see this file as "old" and ignore it or will in repharse it and make duplicate entries to elastic?

Thank you and have a nice day.
Mario

[magnusbaeck (Magnus Bäck)]

In-place overwriting of the kind you're describing should be fine. I don't see why you'd get any duplicates.

[mitabrev]

Thank you Magnus. I can confirm.