What is different between "backoff" and "harvester" in Filebeat?

Elastic Stack Beats
1

As i know:

  • Backoff values define how long it is waited to check a file again after EOF is reached.
  • Harvester: reads each file, line by line, and sends the content to the output.
    So what is the relation between "backoff" and "harvester"?
    and how long to harvester process is finished?
    Could someone help me to clear about this?
2

Each harvester has a read/input pipeline in order to read events from log-files. The harvester forwards published events. The backoff is used by the harvesters input.

and how long to harvester process is finished?

What you mean by finished? Filebeat tries to follow files. There are some close settings that determine when a file is closed. Once the file is closed, the harvester will stop as well.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.