Will the total data gets shipped every time by filebeats?

I want to ship the logs from a server to elk. I would like to know whether all the logs gets shipped everytime or only newly generated logs?

for example logs at point are A+B, they get shipped to elastic search. after 1 hour the logs are A+B+c.
My question is does filebeat ship only new generated C logs?

Filebeat keeps track of the files it has processed and only ships new lines.


List of prospectors to fetch data.

# Each - is a prospector. Below are the prospector specific configurations
#- /var/log/*.log
- C:\filebeattesting\log*.log

registry_file: "C:/ProgramData/filebeat/registry"

Elasticsearch as output

# Array of hosts to connect to.
# Scheme and port can be left out and will be set to the default (http and 9200)
# In case you specify and additional path, the scheme is required: http://localhost:9200/path
# IPv6 addresses should always be defined as: https://[2001:db8::1]:9200
#hosts: [""]
# The Logstash hosts
hosts: [""]

This topic was automatically closed after 21 days. New replies are no longer allowed.