Sincedb data logic

Elastic Stack Logstash
1

Hello!

I have a question regarding how file information is stored in sincedb file. As I understand, structure of file is file inode/major device name/minor device name/byte offset.

What I can see is that all of this information differs from what I get from OS, as example below:

  • data in sincedb:

7260325595195829238 0 90 13990821

  • data from system:

Device: 26h/38d Inode: 11186418478513722378 Links: 1

From system, I would presume major device number is 2 and minor is 6. Also inode number is different.

Would anyone be so kind to explain how this transition is done?

Thank you and best regards,
Bostjan

2

Hi,
Cool question. How did you get these system stats?

3

Hello,

I used "stat" + filename.

Have to point out I am running Logstash in docker (possible reason?).

Best regards,
Bostjan

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.