Logstash Forwarder tails a logfile from the beginning . So it must be sending the whole file to the Logstash whenever even a single line is added to the log file . So don't you think that it will cause a heavy traffic over the network ??????? Say i have a file of 1GB . Hence with each file update will the whole 1GB file will be sent ?????
No, LSF is of course not supposed to do that. If you experience such behavior please tell us exactly what you've done and post relevant logs from LSF.
What you describe could happen if you add a line to the file with a text editor since it probably updates the file by creating a new file (with a new inode number) that's renamed over the original file.