Description
I feel that there should be a separate documentation explaining how to handle logrotation with logstash.
My observation being:-
-> If I use copytruncate and add just the main log file in the logstash path, I miss on some logs since logstash had been processing logs slower than the logs which were arriving and when the rotation is done, logstash is no more able to access the logs using the path provided.
-> If I dont use copytruncate i.e. using the default behaviour(renaming the current main file and creating a new file which is now named same as the old main file), and add the whole directory containing logs as the path for logstash, then problem comes with the logger that it is not able to recognise changes and keeps on writing to the older renamed main file.
There must be an optimal way to handle logrotate with logstash with some specified configurations of both.
There seems to be no right ways present online, any kind of help will be well appreciated.
Thanks