search

driskell / log-courier

The Log Courier Suite is a set of lightweight tools created to ship and process log files speedily and securely, with low resource usage, to Elasticsearch or Logstash instances.
Other
419 stars 107 forks source link

Make log-courier stop watching a file #356

Closed pahool closed 7 years ago

pahool commented 7 years ago

If I change my log-courier.conf file and remove a file pattern from the watch list and then restart log-courier. Log-courier continues to monitor files that no longer match the new file patterns. Is there a way to force log-courier to drop any files that don't match the current pattern without manually editing the offsets file?

driskell commented 7 years ago

Hi

Did you reload or restart? For changes to the watch list I believe a restart is needed. If you restart, it shouldn't be resuming the files if they don't match the pattern. What should happen is it will load the offset file and create entries for each file, but it will only start harvesters when the path scan from your patterns actually finds the file, at which point it knows it has an old offset entry and so "Resumes". Can you double check your configuration and provide it along with logs showing it resuming?

pahool commented 7 years ago

My bad. I was taking presence in the offset file as evidence that the files were still being monitored. I see this is not the case. Thanks for your response.