I'm new to filebeat, and looking for some guidance for a use-case. I'm looking to use filebeat on a remote computer in order to forward a CSV to logstash. The CSV is updated daily. New data is appended throughout the CSV, meaning new data is not entered in the bottom. How do I configure filebeat to send the entire csv to logstash after it has been updated once a day?
You could use the clean_inactive config option together wither ignore_older and set it to value like 2h. That means if the file is updated only once per day, the registry entry will be removed and next time the file is update, not state exists so it will start from scratch.
This topic was automatically closed after 21 days. New replies are no longer allowed.