Craig MacKenzie
Craig MacKenzie
This is affecting agent's own self-monitoring because the log files from the Elastic Agent watcher are frequently smaller than 1024 bytes. See an example in the diagnostics in https://github.com/elastic/elastic-agent/issues/9534, the...
Have we thought about introducing an "identity change" registry operation to allows to remap files to new identities without having to re-ingest them? That would work with an append only...
There is an issue that we should evaluate changes to the on disk format yes, that's https://github.com/elastic/beats/issues/46939. There are no conclusions yet but I would agree if we do plan...
FYI @belimawr as I think you did the initial version of this. Since we already know the fix I am in favour of just doing it.
Is there a test we can add for this?
Yes we need this bug fixed as it's definitely affected people, and yes we need a test showing this correctly fixed the bug.
> 1. enabled -- return error for file identities other than fingerprint > 2. auto (default) -- automatically detect incompatibility, disable gzip if that's the case > 3. disabled --...
I got some feedback from PM (Bill) that we may not want to have this be enabled by default just to minimize any chance of user disruption. Since in general...
> keep the requirement to use fingerprint, if not, error and don't start the input No. There is no reason for Filebeat to exit, you should only warn. You do...
This looks like it will work if you are root, have you found what the least privilege way to execute journalctl is yet? Can you for example be a non-root...