Start_position: beggining

Elastic Stack Logstash
1

Hello,

I am wondering if I set my <start_position: beggining> in my Logstash configuration, if I restart Logstash, will files that have already been processed be reprocessed, or will sincedb protect from reprocessing previously processed files, ecen though I have <start_position: beggining> configuration set?

Thanks in advance Chrome,

2

Logstash will always honour the sincedb contents, if available. Quoting the documentation:

This option only modifies "first contact" situations where a file is new and not seen before, i.e. files that don’t have a current position recorded in a sincedb file read by Logstash. If a file has already been seen before, this option has no effect and the position recorded in the sincedb file will be used.

3

Awesome, thanks Magnus!