Retriving to read the same file

Elastic Stack Beats
1

Hi all

I'm trying to read the same file in order to do some tests in elasticsearch, but if I don't change the name of the file filebeat ignored my decision.

I started the filebeat with the following command
sudo filebeat -e --modules apache2 -M "apache2.access.var.paths=[/apache_logs*]"

Then filebeat processed apache_logs at the first time.
After I stopped the process cancel in elasticsearch the data and I retry to use the same command nothing change, filebeat start and don't process again apache_logs. If I copy apache_logs in apache_logs2 the filebeat processed apache_logs2

In logstash I known that there si a sincedb file, here is there the other file?

Thank you
Franco

2

You can achieve this by deleting the registry file. It is located in /var/lib/filebeat/registry.

3

Thank you Adrian, I try it.
Franco

4

It's ok
Great
thank you Adrian

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.