Gabriel Moskovicz

@eyalkoren have we had any news regarding this implementacion?

@jordansissel what do you think?

Maybe we can just add `mtime` and `file_size`. The byte_offset can be the offset at a certain time, but the actual size of the file maybe is now higher? That's...

In https://github.com/jordansissel/ruby-filewatch/blob/cf60cb421d447581549c5a2f8f736e3c96d74483/lib/filewatch/yielding_tail.rb#L59-L62 I think that we can yield the byte count as well: ``` watched_file.buffer_extract(data).each do |line| yield(watched_file.path, line) @sincedb[watched_file.inode] += (line.bytesize + @delimiter_byte_size) end ``` to something like ```...

SGTM! @ph :+1:

@jsvd is there a way to do this now? All i can think of is creating an aggregation so then we can access the total buckets. Which is a workaround...

This seems to be related to https://github.com/logstash-plugins/logstash-filter-elasticsearch/issues/89 as the count is just another search type.

I like lookup. At least it gives an idea that this is a more generic plugin. @suyograo :+1: :smile: