[7.16.0] Deprecated in 7.16.0. Show
The log input is deprecated. Please use the the Use the To configure this input, specify a list of glob-based
You can apply additional configuration settings (such as To apply different configuration settings to different files, you need to define multiple input sections: Reading files on network shares and cloud providerseditFilebeat does not support reading from network shares and cloud providers. However, one of the limitations of these data sources can be mitigated if you configure Filebeat adequately. By default, Filebeat identifies files based on their inodes and device IDs. However, on network shares and cloud providers these values might change during the lifetime of the file. If this happens Filebeat thinks that file is new and resends the whole content of the file. To solve
this problem you can configure Selecting The option The content of this file must be unique to the device. You can put the UUID of the device or mountpoint where the input is stored. The following example oneliner generates a hidden marker file for the selected mountpoint $ lsblk -o MOUNTPOINT,UUID | grep /logs | awk '{print $2}' >> /logs/.filebeat-marker To set the generated file as a marker for filebeat.inputs: - type: log paths: - /logs/*.log file_identity.inode_marker.path: /logs/.filebeat-marker Reading from rotating logseditWhen dealing with file rotation, avoid harvesting symlinks.
Instead use the Furthermore, to avoid duplicate of rotated log messages, do not use the Configuration optionseditThe
|