0

vector 0.24.1 (x86_64-unknown-linux-gnu 8935681 2022-09-12)

I have bunch of old log files sitting on the server:

$ ls -al /var/opt/app/logs/httpd/access*
-rw-rw---- 1 app app  98836 May 24  2021 /var/opt/app/logs/httpd/access.log.2021-05-24
-rw-rw---- 1 app app 101632 May 25  2021 /var/opt/app/logs/httpd/access.log.2021-05-25
-rw-rw---- 1 app app  97910 Jun  1  2021 /var/opt/app/logs/httpd/access.log.2021-06-01
...
-rw-rw---- 1 app app    732 Sep 19 01:10 /var/opt/app/logs/httpd/access.log.2022-09-19
-rw-rw---- 1 app app    732 Sep 20 01:10 /var/opt/app/logs/httpd/access.log.2022-09-20
-rw-rw---- 1 app app    732 Sep 21 01:10 /var/opt/app/logs/httpd/access.log.2022-09-21

I want the logs to be collected using vector.dev:

[sources.log_files]
type = "file"
include = [ "/var/opt/app/logs/httpd/access.log.*" ]
read_from = "beginning"
ignore_older_secs = 0

What vector does, is to pick up the latest file from the pattern .../access.log.* and collects only what's appended to the file, even though read_from = "beginning" is present.

I can't make it to read all the historical files from the beginning, so I can clean them up. The only way I made vector to really read a file from beginning was to insert a line at the beginning of a file.

Is this a bug or I'm doing something wrong?

Suggested tags: vector, observability

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.