Symlinks with Filebeat

Elastic Stack Beats
1

How does filebeat handle the case where the underlying file changes when using Symlinks. I understand that you have to enable "symlinks: true" for it to process symlinks where it reads the actual file.

But when the underlying file changes does it automatically pick up the new file the symlink is pointing to?

2

Symlinks are tricky. Filebeat tracks files by inode and device ID. I think it uses stat, which gets you the inode of the path given. In case of symlinks this is the symlink itself, not the file you point to. Given that I don't think that filebeat detects you relinking a symlink. An alternative operation filebeat would detect:

  1. Create new temporary symlink with new inode
  2. replace symlink with temporary symlink
$ ln -s source_file symlink.tmp
$ mv symlink.tmp symlink

In general, it's better to not use filebeat with symlinks.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.