I was testing how fiebeat handles file roration case. I found two problems, and I'm not sure if that's caused by my configuration or the filebeat issues.
###Problem A: filebeat didn't read any update in the renamed file
Parts of filebeat configuration, and others keep the default settings.
- paths: - /home/work/test/*.log close_older: 1m
What my operations were:
- created test.log, and appended something into it.
- mv test.log test1.log
- created a new test.log and edited it.
- appended something to test1.log
- check filebeat output
I found filebeat didn't read the update in test1.log. I checked the register file, it did add test1.log entry and the offset, but no matter how much I added into that old file, the offset didn't change. Is that a issue or caused by me incorrect operation/configuration?
###Problem B: wrong file path in filebeat output
Changed "close_older" to 5 minutes. Then same operations as listed above. But keep in mind that, test1.log was modified within 5 minutes.
In this case, filebeat could read any updates in test1.log. But the problem was the file path in its output. Please look at below screenshot.
What I highlighted was the update in test1.log, however, the "source" said it was test.log. Is that a filebeat issue?
Thanks for any help in advance.