Hi, I met a situation where it seemed that filebeat locked the application logs.
The application generates log file like appx.log, after some time or certain size is hit, it will rename the existing appx.log to appx_back.log, and start a new appx.log for logging. when it's time to rename the new appx.log again, it will just rename it and overwrite the existing appx_back.log.
With below filebeat settings, it is observed that application is not able to rename appx.log to appx_back.log, util appx.log reached a few GB, resulting in application crash. Does filebeat actually lock the log files it looks after? for this case, how to resolve it? thank you.
ignore_older: 10m document_type: appx tail_files: true