Filebeat_log_file_path giving weird characters

[SuhasMUFC (Suhas Lekkad)]

Hello All,
I am facing a weird issue w.r.to filebeat.

I am having a Centralise server where I rsync all my production server logs.
I have a log file p1dm.log which I rsync every 10 mins and the file gets rotated after 1 hour.

Filebeat reads the log and then pushes to my Elastic.
In my graylog UI when I select the field **"filebeat_log_file_path " I get two files of p1dm.log with weird characters at end of file.

/graylog/EventLogger/ceaf7/.p1dm.log.r2HY9Y

I dont know why this “r2HY9Y” is getting appended to my log file. After every rsync my file name is getting changed to some random characters at the end of my file name.

Kindly help as I do not want such chars and instead i just need to keep it as p1dm.log as a single file which will be read after every rsync.

[SuhasMUFC (Suhas Lekkad)]

[jan (Jan Doberstein)]

depending on your rsync command this might be the temporary files that are created for/during the rsync.

You might want to make your configuration in filebeat more specific OR you might want to change your rsync command.

[SuhasMUFC (Suhas Lekkad)]

Hello Jan,

This is my rsync command.

sudo rsync -avz server1::graylog_rsync/p1dm/*.log. /graylog/EventLogger/

Can you help me with how can i improve the same.

I am pulling the data from server1.

[jan (Jan Doberstein)]

he @SuhasMUFC

read the man pages if rsync … one way would be to use:

--partial-dir=DIR

https://linux.die.net/man/1/rsync