麋鹿堆栈-Windows上的Filebeat问题

Question

I'm having an issue with filebeat on windowsXP. There is a csv file that is written (every 10/15 seconds) by an application that collect data measurement. Filebeat reads this file every time from scratch and it causes duplicated rows. Any advices?

filebeat.prospectors:
- input_type: log
  paths:
    - C:\nms2k\ems\measure\PERF*.csv
  include_lines: ['RTT','RTJ']
  logging.level: debug
  #----------------------------- Logstash output --------------------------------
  output.logstash:
      hosts: ["xxx.xxx.xxx.xxx:1000"]

Here my registry.log: https://pastebin.com/MbPVgH5S

and here my filebeat.log: https://pastebin.com/A8tqukQT

Answer 1

From the registry file it looks like the file ID is changing every time. I suspect this happens because the application rewrites the whole file, instead of just appending to it. If that's the case, then I'm afraid that Filebeat doesn't currently support that, so check if it can be changed on the application side.