I have filebeat 7.15 streaming logs to my elasticsearch via this setup

Application -> Logfile -> Filebeat -> Logstash -> Elasticsearch -> kibana

in the case of filebeat shut down ,Will Filebeat be able to detect which logs are sent during it's downtime and automatically send them to logstash when it is turned back on?

CodePudding user response：

Filebeat keeps the state of the point until which a fiel was read in his registry file. If it's down, nothing is sent and when it starts back it will pick from where it left.

As far as log rotation goes, there are techniques to avoid data loss.