以下是我从logstash输入的conf:
input {
file {
path => "/usr/local/elk/mos-log/mt.log"
type => "mos-mt-log"
codec => multiline {
pattern => "^\["
negate => true
what => "next"
}
start_position => "end"
}
file {
path => "/usr/local/elk/mos-log/rpt.log"
type => "mos-rpt-log"
codec => multiline {
pattern => "^\["
negate => true
what => "next"
}
start_position => "end"
}}
每当我手动将日志添加到日志中时,Logstash始终会从头到尾读取日志。你如何确保Logstash从最后读取日志? 字段start_position => conf中的“end”不起作用