You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
When the include_message field is used, the offset is only updated based on the length of the message read, it ignores the amount of data read and not ingested.
How to reproduce
Create a file (/tmp/foo.log) with the following content:
For confirmed bugs, please report:
main
When the
include_message
field is used, the offset is only updated based on the length of the message read, it ignores the amount of data read and not ingested.How to reproduce
/tmp/foo.log
) with the following content:filebeat.yml
with the following content:The problem happens because the
parser.FilterParser
does not account for the size of the lines it discards.beats/libbeat/reader/filter/filter.go
Lines 58 to 70 in a6aa347
Then when Filestream gets the message, it increases the file offset by the message's size instead of the amount of bytes advanced in the file.
beats/filebeat/input/filestream/input.go
Lines 356 to 372 in a6aa347
The text was updated successfully, but these errors were encountered: