Permanent truncate detection

Elastic Stack Beats
1

Each 10min filebeat resending file to ELK. In logs we can find "File was truncated. Reading file from offset 0....". File wasn't rotated (state-id the same) or truncated. This file rotated daily only by logrotate (daily, delaycompress). Is any known opened bugs? I am using 8.11.1
Config

- ignore_older: 1h
  paths:
  - /log/*.json*
  prospector.scanner.exclude_files:
  - \.gz$
  - \.xz$
  type: filestream
2

Any ideas? Or maybe you need additional information? This is starting to get very annoying. But still can't reproduce this in a test environment.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.