[ File input and logs rotation ]

[jerome83136]

Hi,
I have launched node-logstash to process my logs yesterday.
My logs have been read and merged in the relevant output files.

These logs are Apache access logs and they are rotated every day at 03:00 am
If the input file rotates, how will node-logstash handle it ? Will the new file (after rotation) been read from the beginning ? How will the .dbfile be managed ?

I have read the documentation and it talks about this:

use_tail: use system tail -f command to monitor file, instead of built in file monitoring. Should be used with logrotate and copytuncate option. Defaut value: false.

So I guess there is a special way to deal with "rotating" input file. But what is the good approach ? Do I have to use "use_tail" or can I achieve the same thing with the built-in file reader ?

Many thanks for your time

Best regards
Jérôme

[bpaquet]

Hi,

The standard file input (without tail), is, on Linux, compatible with logrotate, copytruncate or standard mode.
I did lot of test on this point (it was the first node-logstash feature), and use it in production.

I have updated the doc to be more precise.

Regards,

Bertrand