Description
openedon Nov 8, 2024
Please post all questions and issues on https://discuss.elastic.co/c/beats
before opening a Github Issue. Your questions will reach a wider audience there,
and if we confirm that there is a bug, then you can open a new issue.
For security vulnerabilities please only send reports to security@elastic.co.
See https://www.elastic.co/community/security for more information.
Please include configurations and logs if available.
For confirmed bugs, please report:
- Version: 8.15.2
- Operating System: centos 7
as as write frenquency log file, such as nginx access.log, filebeat config:
ignore_inactive: "since_last_start"
is not work.
i see the code:
func (p *fileProspector) isFileIgnored(log *logp.Logger, fe loginp.FSEvent, ignoreInactiveSince time.Time) bool {
。。。
if !ignoreInactiveSince.IsZero() && fe.Info.ModTime().Sub(ignoreInactiveSince) <= 0 {
log.Debugf("Ignore file because ignore_since.* reached time %v. File %s", p.ignoreInactiveSince, fe.NewPath)
return true
}
return false
}
when log file is always writing, and its modTime > sinceTime very possibly.
my suggestion:why not read the file bytes of sinceTime, and directly set to offset.