What is the best practice to avoid this case Example,

filebeat   5098  5128       root    3r      REG              253,1 31035908096     657022 /var/log/aaa/aaa.access.log.1 (deleted)

There is a logrotate to mv aaa.access.log file while processed by filebeat. nano and tail can be stucking a file but i am focusing on filebeat app. What is the best practice to solve this permanently ? Especially, filebeat app.

  • 1
    Since filebeat is long-running, you will likely need the copytruncate option offered by logrotate.
    – Haxiel
    Jan 7, 2019 at 7:53
  • @Haxiel i have 166 ansible scripts. Adding copytruncate to each file is not good idea. I know it works. But do you have other way to avoid that pls ?
    – Nicky Puff
    Jan 7, 2019 at 9:57
  • 2
    I'm not quite sure what you mean. The QA you've linked shows how to solve this manually by truncating the file. Since you're already using logrotate, copytruncate will do this automatically. What's missing here?
    – Haxiel
    Jan 7, 2019 at 10:35
  • @Haxiel nvm, got it mate
    – Nicky Puff
    Jan 8, 2019 at 0:53


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.