diff --git a/filebeat/input/log/input.go b/filebeat/input/log/input.go index df3cc226771c..d9dde5970e46 100644 --- a/filebeat/input/log/input.go +++ b/filebeat/input/log/input.go @@ -548,15 +548,28 @@ func (p *Input) harvestExistingFile(newState file.State, oldState file.State) { } // File size was reduced -> truncated file - if oldState.Finished && newState.Fileinfo.Size() < oldState.Offset { - logp.Debug("input", "Old file was truncated. Starting from the beginning: %s, offset: %d, new size: %d ", newState.Source, newState.Offset, newState.Fileinfo.Size()) - err := p.startHarvester(newState, 0) - if err != nil { - logp.Err("Harvester could not be started on truncated file: %s, Err: %s", newState.Source, err) - } + if oldState.Finished { + if oldState.Fileinfo == nil && newState.Fileinfo.Size() < oldState.Offset { + logp.Err("Old file was truncated. Starting from the beginning: %s, old source: %s, offset: %d, new size: %d,"+ + " old StateOS: %s, new StateOS: %s", newState.Source, oldState.Source, oldState.Offset, newState.Fileinfo.Size(), oldState.FileStateOS.String(), newState.FileStateOS.String()) + err := p.startHarvester(newState, 0) + if err != nil { + logp.Err("Harvester could not be started on truncated file: %s, Err: %s", newState.Source, err) + } - filesTruncated.Add(1) - return + filesTruncated.Add(1) + return + } else if oldState.Fileinfo != nil && newState.Fileinfo.Size() < oldState.Fileinfo.Size() { + logp.Err("Old file was truncated. Starting from the beginning: %s, old source: %s, offset: %d, old size: %d, new size: %d,"+ + " old StateOS: %s, new StateOS: %s", newState.Source, oldState.Source, oldState.Offset, oldState.Fileinfo.Size(), newState.Fileinfo.Size(), oldState.FileStateOS.String(), newState.FileStateOS.String()) + err := p.startHarvester(newState, 0) + if err != nil { + logp.Err("Harvester could not be started on truncated file: %s, Err: %s", newState.Source, err) + } + + filesTruncated.Add(1) + return + } } // Check if file was renamed