Skip to content

Log Files

Log Files (files)

Monitor one or more log files for new lines.

File binary json raw

Minimal example

input:
files:
path: ""
JSON
{
"input": {
"files": {
"path": ""
}
}
}

Contents

Behavior

Behavior
FieldTypeRequiredDescription
encodingencoding (string)the text encoding for the monitored files.
Default: UTF-8
Examples: UTF-8
stop-reading-afterboolean (bool)do not wait for new files.
Default: false
ignore-line-breaksboolean (bool)consume each file as one event.
Default: false
payload-modePayload ModeSelect how file content should be interpreted (auto, json, raw, binary).
Default: auto
Allowed values: auto, json, raw, binary
remove-afternumber (integer)remove files that are done reading after this period (seconds).
Examples: 42, 1.2e-10
oldest-firstboolean (bool)default is youngest first.
Default: false
file-basenameboolean (bool)the file-path-field path will be the basename (e.g. ‘/path/frodo.txt’ becomes just ‘frodo’).
Default: false
start-at-beginningboolean (bool)ignore stored checkpoints and re-read all specified files.
Default: false
jsonboolean (bool)assume lines are already JSON.
Default: false

Filtering

Filtering
FieldTypeRequiredDescription
ignore-older-thannumber (integer)ignore files older than this (epoch time in seconds).
Examples: 42, 1.2e-10

Location

Location
FieldTypeRequiredDescription
pathpath (string)a path with wildcards identifying files to be read.
Examples: /path/to/file, c:\users\joe\data\file.txt
includepath[] (string)any other paths to be included.
Examples: /path/to/file, c:\users\joe\data\file.txt
excludepath[] (string)paths to be excluded.
Examples: /path/to/file, c:\users\joe\data\file.txt

Object Properties

Object Properties
FieldTypeRequiredDescription
file-path-fieldfield (string)fill this field with the file we are currently reading from.
Examples: data_field

Performance

Performance
FieldTypeRequiredDescription
glob-minimum-cooldownnumber (integer)pause after scanning for new files (in milliseconds).
Default: 300
Examples: 42, 1.2e-10
max-read-sizenumber (integer)will not attempt to read files larger than this.
Default: 100MB
Examples: 42, 1.2e-10
max-line-sizenumber (integer)will not attempt to read lines longer than this.
Default: 1MB
Examples: 42, 1.2e-10

Reliability

Reliability
FieldTypeRequiredDescription
fingerprintingFingerprint StrategyFile fingerprinting strategy.
Default: dev-inode
Allowed values: checksum, first-line-checksum, dev-inode

Schema

Fingerprint Strategy Options

OptionNameTypeDescription
checksumChecksumobjectFingerprint strategy is set to a checksum of the start of the file determined by the bytes that are skipped (ignored-header-bytes) and then the fingerprint size in bytes.
first-line-checksumFirst Line ChecksumobjectFingerprint strategy that uses the first line of the file to detect if a file has changed.
dev-inodeDev InodesymbolFingerprint strategy is set to the inode of the file causing the file monitor to detect new files when a file is recreated.
Allowed values: fingerprinter-dev-inode

Fingerprint Strategy - Checksum Fields

FieldTypeRequiredDescription
fingerprint-bytesnumber (integer)The number of bytes to use for the fingerprint, starts after ignore-header-bytes if specified.
Examples: 42, 1.2e-10
ignored-header-bytesnumber (integer)The number of bytes from the start of the file to ignore before starting the fingerprint.
Examples: 42, 1.2e-10

Fingerprint Strategy - First Line Checksum Fields

FieldTypeRequiredDescription
max-line-lengthnumber (integer)The maximum number of bytes to read from the first line of the file to calculate the fingerprint.
Examples: 42, 1.2e-10

Payload Mode Options

ValueNameDescription
autoautoAuto
jsonjsonJson
rawrawRaw
binarybinaryBinary

Fingerprint Strategy - Dev Inode Options

ValueNameDescription
fingerprinter-dev-inodefingerprinter-dev-inodeFingerprint strategy is set to the inode of the file causing the file monitor to detect new files when a file is recreated