Regarding ignore fieds

Elastic Stack Beats
1

Hi team,

We would like to explore the ignore fields in Filebeat.

Our purpose is to deleted the older files after denoted the value looks below.

ignore older

After implemented the ignore_older as 2h in filebeat. The logs has stopped in kibana and it was not deleted as per implemented.

Could you please suggest us, how to delete the older logs and where we need to do that.

Thanks,
Yasar Arafaath A.

2

Please don't post pictures of text, logs or code. They are difficult to read, impossible to search and replicate (if it's code), and some people may not be even able to see them :slight_smile:

3

Hello Mark,

Sorry for the inconvenience,

Kindly find the below yaml file from filebeat.


- type: log
  enabled: true
  paths:
    - /var/log/*
  ignore_older: 2h
  fields_under_root: true
  fields:
       topic_name: -------
       logtype: ----------

Thanks & Regards,
Yasar Arafaath A.

4

Take a look at Log input | Filebeat Reference [8.4] | Elastic, it doesn't delete it only ignores files older than that period.

5

Hello Mark,

Thanks for the reply,

If we implemented the ignore older like 2h , it will ignore the older logs for 2h.

Here, we have one query..

So, after one 2h we can get the fresh logs only.., right ?? It will ignore the older logs means, we have not getting the 2h of logs that we are implemented ?

Thanks,
Yasar Arafaath A.

6

Yes, it means that after a file is 2 hours old, Filebeat will stop tracking and reading from it. And will only look at any other files that are less than 2 hours old.

7

Hello Mark,

Thanks for the reply,

And will only look at any other files that are less than 2 hours old

 So, we can't receive the older logs after we implemented it.. we can receive only the fresh logs after implemented for 2h right ??

Thanks,
Yasar Arafaath A.

8

Hello Mark,

Can i take my perception is correct ?

Thanks,
Yasar Arafaath A.

9

Yes that is correct.

10

Hello Mark,

Thanks for the quick reply.

Thanks,
Yasar Arafaath A.

11

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.