From bb50d32ead2945b5c982e7975ab6ef6b3625860a Mon Sep 17 00:00:00 2001 From: William Deurwaarder Date: Wed, 21 Oct 2020 14:45:12 +0200 Subject: [PATCH] Prevent log input from sending duplicate messages due to file renaming (#21911) Input:Log: Reset TTL of registry state when a file is renamed. In some rare cases the registry state is marked for removal (TTL is set to 0) while the file is only renamed. Log detects the renaming of the file and updates the name of the file. As the file still exists it should also update the TTL of the renamed file. --- filebeat/input/log/input.go | 1 + 1 file changed, 1 insertion(+) diff --git a/filebeat/input/log/input.go b/filebeat/input/log/input.go index 365da416ed3..1b203adcf5e 100644 --- a/filebeat/input/log/input.go +++ b/filebeat/input/log/input.go @@ -566,6 +566,7 @@ func (p *Input) harvestExistingFile(newState file.State, oldState file.State) { logp.Debug("input", "Updating state for renamed file: %s -> %s, Current offset: %v", oldState.Source, newState.Source, oldState.Offset) // Update state because of file rotation oldState.Source = newState.Source + oldState.TTL = newState.TTL err := p.updateState(oldState) if err != nil { logp.Err("File rotation state update error: %s", err)