-
How Filebeat Works
Filebeat
consists of two main components:input
andharvesters
. -
Harvester
A harvester is responsible for reading the content of a single file.
The harvester reads each file, line by line, and sends the content to the output.
One harvester is started for each file. The harvester is responsible for opening and closing the file, which means that the file descriptor remians open while the harvester is running.
If a file is removed or renamed while it’s being harvested, Filebeat continues to read the file. This has the side effect that the space on your disk is reserved until the harvester closes.
By default, Filebeat keeps the file open until
close_inactive
is reached. -
Input
An input is resonsible for managing
深入理解Elasticsearch-Filebeat: config and mechanism
最新推荐文章于 2022-03-13 20:57:58 发布