IMPORTANT: No additional bug fixes or documentation updates will be released for this version. For the latest information, see the current release documentation.
« Step 1: Set an identifier for each filestream input Step 3: Use new option names »
Elastic Docs ›Filebeat Reference [8.13] ›How to guides ›Migrate log input configurations to filestream

Step 2: Enable the take over mode

edit

Step 2: Enable the take over mode

edit

Now, to indicate that the new filestream is supposed to take over the files from a previously defined log input, we need to add take_over: true to each new filestream. This will make sure that the new filestream inputs will continue ingesting files from the same offset where the log inputs stopped.

It’s recommended to enable debug-level logs for Filebeat in order to follow the migration process. After the first run with take_over: true the setting can be removed.

The take over mode is in beta.

If this parameter is not set, all the files will be re-ingested from the beginning and this will lead to data duplication. Please, double-check that this parameter is set.

logging:
  level: debug
filebeat.inputs:
- type: filestream
  enabled: true
  id: my-java-collector
  take_over: true
  paths:
    - /var/log/java-exceptions*.log

- type: filestream
  enabled: true
  id: my-application-input
  take_over: true
  paths:
    - /var/log/my-application*.json

- type: filestream
  enabled: true
  id: my-old-files
  take_over: true
  paths:
    - /var/log/my-old-files*.log
« Step 1: Set an identifier for each filestream input Step 3: Use new option names »