elastic / elastic/integrations
[Apache Tomcat]: Allow configuring file identity parameters
- Dominant language
- Handlebars
- Stars
- 333
- Forks
- 647
- Avg merge
- 3d 4h
- Merged PRs (30d)
- 209
Description
### Integration Name
Apache Tomcat [apache_tomcat]
### Dataset Name
_No response_
### Integration Version
1.11.0
### Agent Version
9.1.4
### OS Version and Architecture
Ubuntu jammy(22.04.2 LTS (Jammy Jellyfish)) x86_64
### User Goal
Ingest files of any size, more specifically < 1024 bytes
### Existing Features
It is not possible to configure the file identity for Filestream. Two things are missing:
- The ability to choose the file identity
- The ability to configure the fingerprint parameters when using Fingerprint file identity (the default one)
### What did you see?
Data is not ingested because the log file is too small.
Debug Log:
```
cannot start ingesting from file "/fobar.log": filesize of "/fobar.log" is 42 bytes, expected at least 1024 bytes for fingerprinting: file size is too small for ingestion
```
Warning log:
```
42 files are too small to be ingested, files need to be at least 1024 in size for ingestion to start. To change this behaviour set 'prospector.scanner.fingerprint.length' and 'prospector.scanner.fingerprint.offset'. Enable debug logging to see all file names.
```
### Anything else?
Changing file identity in most cases will case all existing files to be re-ingested, this is well [documented](https://www.elastic.co/docs/reference/beats/filebeat/filebeat-input-filestream#filebeat-input-filestream-file-identity).
There is also an open issue to allow ingesting files of any size when using fingerprint file identity: https://github.com/elastic/beats/issues/44780
Contributor guide
Assessment
This issue has not been assessed yet.