Will filebeat handle properly the underlying log file rotation?

while filebeat uses file metadata like inode and device id in order to track files, it still requires the full path in order to open files. The prospectors can only find files by path and do check inode/device id against known set of inodes.

If a file is simply renamed or closed by the logger, but still open by filebeat, filebeat will process until end (will not close file handle yet). But if filebeat gets restarted in between, it needs to find the renamed files again. In order to find renamed files, the glob pattern must match rotated files too. So to say, it's better use pattern mysqld.log*.

3 Likes