Sidehistorik
...
| Kodeblok |
|---|
Mon Apr 4 19:02:01 CEST 2016: 64 bytes from 194.88.5.66: icmp_seq=1 ttl=245 pingtime=12.7 ms Mon Apr 4 19:03:01 CEST 2016: 64 bytes from 194.88.5.66: icmp_seq=1 ttl=245 pingtime=12.0 ms Mon Apr 4 19:04:01 CEST 2016: 64 bytes from 194.88.5.66: icmp_seq=1 ttl=245 pingtime=14.4 ms Mon Apr 4 19:05:01 CEST 2016: 64 bytes from 194.88.5.66: icmp_seq=1 ttl=245 pingtime=12.0 ms Mon Apr 4 19:06:01 CEST 2016: 64 bytes from 194.88.5.66: icmp_seq=1 ttl=245 pingtime=11.9 ms Mon Apr 4 19:07:01 CEST 2016: 64 bytes from 194.88.5.66: icmp_seq=1 ttl=245 pingtime=11.7 ms Mon Apr 4 19:08:01 CEST 2016: 64 bytes from 194.88.5.66: icmp_seq=1 ttl=245 pingtime=12.9 ms Mon Apr 4 19:09:01 CEST 2016: 64 bytes from 194.88.5.66: icmp_seq=1 ttl=245 pingtime=12.3 ms Mon Apr 4 19:10:01 CEST 2016: 64 bytes from 194.88.5.66: icmp_seq=1 ttl=245 pingtime=12.5 ms Mon Apr 4 19:11:01 CEST 2016: 64 bytes from 194.88.5.66: icmp_seq=1 ttl=245 pingtime=12.2 ms |
After truncating the log file
| Kodeblok |
|---|
cat /dev/null > /var/log/ping-kaf.txt |
Filebeat found the truncation and started reading:
| Kodeblok |
|---|
2016-04-04T19:14:23+02:00 DBG File was truncated as offset (%!s(int64=145700)) > size (%!s(int64=0)). Begin reading file from offset 0: /var/log/ping-kaf.txt
2016-04-04T19:14:23+02:00 INFO File was truncated. Begin reading file from offset 0: /var/log/ping-kaf.txt
2016-04-04T19:14:23+02:00 DBG End of file reached: /var/log/ping-kaf.txt; Backoff now.
2016-04-04T19:14:28+02:00 DBG Flushing spooler because of timeout. Events flushed: 0
2016-04-04T19:14:28+02:00 DBG Start next scan
2016-04-04T19:14:28+02:00 DBG scan path /var/log/ping-kaf.txt
2016-04-04T19:14:28+02:00 DBG Check file for harvesting: /var/log/ping-kaf.txt
2016-04-04T19:14:28+02:00 DBG Update existing file for harvesting: /var/log/ping-kaf.txt
2016-04-04T19:14:28+02:00 DBG Not harvesting, file didn't change: /var/log/ping-kaf.txt
...
...
...
...
...
2016-04-04T19:18:15+02:00 DBG End of file reached: /var/log/ping-kaf.txt; Backoff now.
4-04T19:18:16+02:00 DBG Flushing spooler because of timeout. Events flushed: 3
2016-04-04T19:18:16+02:00 DBG Publish: {
"@timestamp": "2016-04-04T17:18:08.976Z",
"beat": {
"hostname": "afserver",
"name": "afserver"
},
"count": 1,
"fields": null,
"input_type": "log",
"message": "Mon Apr 4 19:18:01 CEST 2016: 64 bytes from 194.88.5.66: icmp_seq=1 ttl=245 pingtime=11.4 ms",
"offset": 282,
"source": "/var/log/ping-kaf.txt",
"type": "pinglog"
}
...
...
...
...
...
016-04-04T19:21:08+02:00 DBG Publish: {
"@timestamp": "2016-04-04T17:21:03.983Z",
"beat": {
"hostname": "afserver",
"name": "afserver"
},
"count": 1,
"fields": null,
"input_type": "log",
"message": "Mon Apr 4 19:21:01 CEST 2016: 64 bytes from 194.88.5.66: icmp_seq=1 ttl=245 pingtime=12.2 ms",
"offset": 564,
"source": "/var/log/ping-kaf.txt",
"type": "pinglog"
} |