Filebeat: How to send only the newly added log events instead of the entire content of a log file

[SMavr]

I am using Filebeat to send via a Logstash pipeline some log entries into an elasticsearch server. The problem is whenever I add a new line to the log file, it sends all the log events of the file. I tried setting the input_type to stdin in the filebeat configuration file. But in that case nothing is transferred if I write a new line into the log file.

Is there any way to send only the new log entry and not the entire content of the log file?

[ruflin]

I think what you are looking for is tail_files: https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-configuration-details.html#_tail_files

Please use the discuss forum for questions instead of Github issues: https://discuss.elastic.co/c/beats/filebeat

[SMavr]

Thanks for the info! The problem was that I just did a copy paste. I created a console program writing a line into the file and it works prefect!