diff --git a/CHANGELOG.asciidoc b/CHANGELOG.asciidoc index f39869165d54..4247fef76f83 100644 --- a/CHANGELOG.asciidoc +++ b/CHANGELOG.asciidoc @@ -65,6 +65,12 @@ https://github.com/elastic/beats/compare/v1.2.3...1.2[Check the HEAD diff] === Beats version 1.2.3 https://github.com/elastic/beats/compare/v1.2.2...v1.2.3[View commits] +==== Added + +*Filebeat* + +- Prevent file opening for files which reached ignore_older. + ==== Bugfixes *Topbeat* diff --git a/filebeat/crawler/prospector.go b/filebeat/crawler/prospector.go index 8e6f6c9413b9..58532930dbc6 100644 --- a/filebeat/crawler/prospector.go +++ b/filebeat/crawler/prospector.go @@ -358,6 +358,11 @@ func (p *Prospector) checkNewFile(newinfo *harvester.FileStat, file string, outp p.ProspectorConfig.IgnoreOlderDuration != 0 && time.Since(newinfo.Fileinfo.ModTime()) > p.ProspectorConfig.IgnoreOlderDuration { + if oldState.offset == newinfo.Fileinfo.Size() { + logp.Debug("prospector", "File size of ignore_file didn't change. Nothing to do: %s", file) + return + } + logp.Debug("prospector", "Fetching old state of file to resume: %s", file) // Are we resuming a dead file? We have to resume even if dead so we catch any old updates to the file @@ -374,7 +379,7 @@ func (p *Prospector) checkNewFile(newinfo *harvester.FileStat, file string, outp p.ProspectorConfig.IgnoreOlderDuration, time.Since(newinfo.Fileinfo.ModTime()), file) - newinfo.Skip(newinfo.Fileinfo.Size()) + h.SetOffset(newinfo.Fileinfo.Size()) } p.registrar.Persist <- h.GetState() } else if previousFile, err := p.getPreviousFile(file, newinfo.Fileinfo); err == nil { diff --git a/filebeat/harvester/harvester.go b/filebeat/harvester/harvester.go index 2c97b5249795..48e5535be804 100644 --- a/filebeat/harvester/harvester.go +++ b/filebeat/harvester/harvester.go @@ -106,7 +106,3 @@ func (fs *FileStat) Continue(old *FileStat) { fs.Return = old.Return } } - -func (fs *FileStat) Skip(returnOffset int64) { - fs.Return <- returnOffset -} diff --git a/filebeat/tests/system/test_registrar.py b/filebeat/tests/system/test_registrar.py index 0150d9a4180d..0f75fbfdca1c 100644 --- a/filebeat/tests/system/test_registrar.py +++ b/filebeat/tests/system/test_registrar.py @@ -395,10 +395,11 @@ def test_state_after_rotation_ignore_older(self): if os.name == "nt": # Under windows offset is +1 because of additional newline char assert data[os.path.abspath(testfile1)]["offset"] == 9 + assert data[os.path.abspath(testfile2)]["offset"] == 8 else: assert data[os.path.abspath(testfile1)]["offset"] == 8 + assert data[os.path.abspath(testfile2)]["offset"] == 7 - assert data[os.path.abspath(testfile2)]["offset"] == 0 # Rotate files and remove old one os.rename(testfile2, testfile3)