Hi
Is there any chance to config some parameters for sincedb for read file only for name, I have updated folder with the second server over rsync and after synchronization data structure are overwrite like inode and etc but still I have the same one name of files. Do You have some solution for avoid reload the same file to elasticsearch?
I found that it should be add param --inplace but it doesn't work. Logstash with sincedb are duplicated still the same file.
&& rsync -va --append --inplace --times --progress --stats
No. filewatch doesn't care much about the file name, it's just a way to find an inode. If a new inode appears then it is treated as new content. If it is a duplicate of an inode that has already been read then the content will be ingested a second time.
If the name associated with the inode changes then that is typically assumed to be a rotated log file that does not need to be read again.
If the file is copied to another disk then both the device number and inode will change, and filewatch uses the combination of the two to track things.
in my case, rsync are works as expected till power on logstash and process the files. So I have doubts that logstash can do something with this file. And then rsync are lost consistency