From 854b1194cf34353d048374c6ac8dc7c122350458 Mon Sep 17 00:00:00 2001 From: William Deurwaarder Date: Fri, 16 Oct 2020 17:03:20 +0200 Subject: [PATCH] [Filebeat] Prevent 'log' sending duplicate messages due to renaming Input:Log: Reset TTL of registry state when a file is renamed. In some rare cases the registry state is marked for removal (TTL is set to 0) while the file is only renamed. Log detects the renaming of the file and updates the name of the file. As the file still exists it should also update the TTL of the renamed file. --- filebeat/input/log/input.go | 1 + 1 file changed, 1 insertion(+) diff --git a/filebeat/input/log/input.go b/filebeat/input/log/input.go index 365da416ed3..1b203adcf5e 100644 --- a/filebeat/input/log/input.go +++ b/filebeat/input/log/input.go @@ -566,6 +566,7 @@ func (p *Input) harvestExistingFile(newState file.State, oldState file.State) { logp.Debug("input", "Updating state for renamed file: %s -> %s, Current offset: %v", oldState.Source, newState.Source, oldState.Offset) // Update state because of file rotation oldState.Source = newState.Source + oldState.TTL = newState.TTL err := p.updateState(oldState) if err != nil { logp.Err("File rotation state update error: %s", err)