elastic / elastic/integrations

[Apache Tomcat]: Allow configuring file identity parameters

Open
#15,490 0 comments 0 reactions 0 assignees View on GitHub
Integration:apache_tomcat needs:triage Team:Obs-InfraObs
Dominant language
Handlebars
Stars
333
Forks
647
Avg merge
3d 4h
Merged PRs (30d)
209

Description

### Integration Name

Apache Tomcat [apache_tomcat]

### Dataset Name

_No response_

### Integration Version

1.11.0

### Agent Version

9.1.4

### OS Version and Architecture

Ubuntu jammy(22.04.2 LTS (Jammy Jellyfish)) x86_64

### User Goal

Ingest files of any size, more specifically < 1024 bytes

### Existing Features

It is not possible to configure the file identity for Filestream. Two things are missing:
- The ability to choose the file identity
- The ability to configure the fingerprint parameters when using Fingerprint file identity (the default one)

### What did you see?

Data is not ingested because the log file is too small.

Debug Log:
```
cannot start ingesting from file "/fobar.log": filesize of "/fobar.log" is 42 bytes, expected at least 1024 bytes for fingerprinting: file size is too small for ingestion
```

Warning log:
```
42 files are too small to be ingested, files need to be at least 1024 in size for ingestion to start. To change this behaviour set 'prospector.scanner.fingerprint.length' and 'prospector.scanner.fingerprint.offset'. Enable debug logging to see all file names.
```

### Anything else?

Changing file identity in most cases will case all existing files to be re-ingested, this is well [documented](https://www.elastic.co/docs/reference/beats/filebeat/filebeat-input-filestream#filebeat-input-filestream-file-identity).

There is also an open issue to allow ingesting files of any size when using fingerprint file identity: https://github.com/elastic/beats/issues/44780

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.