IMPORTANT: No additional bug fixes or documentation updates will be released for this version. For the latest information, see the current release documentation.
« Step 1: Set an identifier for each filestream input Step 3: Use new option names »
Elastic Docs ›Filebeat Reference [8.9] ›How to guides ›Migrate log input configurations to filestream

Step 2: Enable the take over mode

edit
IMPORTANT: This documentation is no longer updated. Refer to Elastic's version policy and the latest documentation.

Step 2: Enable the take over mode

edit

Now, to indicate that the new filestream is supposed to take over the files from a previously defined log input, we need to add take_over: true to each new filestream. This will make sure that the new filestream inputs will continue ingesting files from the same offset where the log inputs stopped.

The take over mode is in beta.

If this parameter is not set, all the files will be re-ingested from the beginning and this will lead to data duplication. Please, double-check that this parameter is set.

filebeat.inputs:
- type: filestream
  enabled: true
  id: my-java-collector
  take_over: true
  paths:
    - /var/log/java-exceptions*.log

- type: filestream
  enabled: true
  id: my-application-input
  take_over: true
  paths:
    - /var/log/my-application*.json

- type: filestream
  enabled: true
  id: my-old-files
  take_over: true
  paths:
    - /var/log/my-old-files*.log
« Step 1: Set an identifier for each filestream input Step 3: Use new option names »