elastic / elastic/beats

Log input can misclassify renamed file as new file

Open
#44,544 2 comments 0 reactions 0 assignees View on GitHub
bug Stalled Team:Elastic-Agent-Data-Plane
Dominant language
Go
Stars
12.7k
Forks
5k
Avg merge
2d 2h
Merged PRs (30d)
364

Description

Found via failing tests on main ([for example](https://buildkite.com/elastic/filebeat/builds/17764#0196f9cd-e97e-42d3-b15a-2ff8e39a9997)): there seems to be a race condition such that sometimes the log input detects that a file has been renamed, but can't update its metadata because its existing harvester hasn't finished, giving many log messages of the form `File rename detected but harvester not finished yet`. However, when the harvester does finish, the file is immediately reopened by a new harvester as a new file instead of finishing the metadata update.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.