I'm new to filebeat and wanted to know how scan_frequency in filebeat actually works.
When using the default scan frequency which is 10s, Our files of size around 400MB (sending the whole file at once using the multiline configuration in filebeat.yml) are splitting into two messages.
Updating the scan_frequency to 5 min and multiline.timeout to 30s reduced the number of files that are getting splitted.
So, My question is - Suppose scan frequency is 10s. At the end of 10s, by the time the scan frequency starts its next round if it founds a file being read by harvestor which was started in the previous round, will the filebeat stops harvestor and continues it in the next iteration of scan frequency or will it don't disturb that file so that harvestor closes its file only after completion of its reading?