Learning Elastic Stack 6.0

File

The file plugin is used to stream events from file(s) line by line. It works in a similar fashion to the tail -0f linux\unix command. For each file, it keeps track of any changes in the file, and the last location from where the file was read only sends the data since it was last read. It also automatically detects file rotation. This plugin also provides the option to read the file from the beginning of the file.

The file plugin keeps account of the current position in each file. It does so by recording the current position in a separate file named sincedb. This not only makes it possible but also convenient to stop and restart Logstash and have it pick up where it left off without missing the lines that were added to the file while ...