Symlinks with Filebeat

How does filebeat handle the case where the underlying file changes when using Symlinks. I understand that you have to enable "symlinks: true" for it to process symlinks where it reads the actual file.

But when the underlying file changes does it automatically pick up the new file the symlink is pointing to?

Symlinks are tricky. Filebeat tracks files by inode and device ID. I think it uses stat, which gets you the inode of the path given. In case of symlinks this is the symlink itself, not the file you point to. Given that I don't think that filebeat detects you relinking a symlink. An alternative operation filebeat would detect:

  1. Create new temporary symlink with new inode
  2. replace symlink with temporary symlink
$ ln -s source_file symlink.tmp
$ mv symlink.tmp symlink

In general, it's better to not use filebeat with symlinks.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.