filebeat日志切割后不影响

1、
[root@master filebeat-8.8.0-linux-x86_64]# cat filebeat.yml
filebeat.inputs:
- type: log
  enabled: true

  paths:
    - /var/log/elink.log
  fields_under_root: true
  fields:
     source: 192.168.137.200
     app_name: elink
     file_tag: midsys
                   
output.console:
  pretty: true
  enable: true
  
 2、
#!/usr/bin/python
# -*- coding: UTF-8 -*-
import time

# 打开一个文件
with open('/var/log/elink.log', 'w', buffering=1)as f:
    for i in range(100000):
        f.write(str(time.time()) + "\n")
        time.sleep(1)

3、
[root@master ~]# ps -ef | grep -i python
root      1111     1  0 Aug09 ?        00:00:15 /usr/bin/python2 -Es /usr/sbin/tuned -l -P
root      7565  5723  0 07:43 pts/2    00:00:00 python a1.py
root      7904  6149  0 07:44 pts/3    00:00:00 grep --color=auto -i python
[root@master ~]# lsof -p 7565|grep elink
python  7565 root    3w   REG  253,0      1051 136764231 /var/log/elink.log

[root@master ~]# lsof -p 7195|grep elink
filebeat 7195 root    9r      REG              253,0      1478 136764231 /var/log/elink.log
[root@master ~]# 

[root@master ~]# ps -ef | grep -i filebeat
root      7195  7194  1 07:43 pts/1    00:00:01 ./filebeat -e -c filebeat.yml
root      8067  6149  0 07:44 pts/3    00:00:00 grep --color=auto -i filebeat
[root@master ~]# lsof -p 7195|grep elink
filebeat 7195 root    9r      REG              253,0      1478 136764231 /var/log/elink.log

4、mv文件,

[root@master ~]# ps -ef | grep -i python
root      1111     1  0 Aug09 ?        00:00:15 /usr/bin/python2 -Es /usr/sbin/tuned -l -P
root      7565  5723  0 07:43 pts/2    00:00:00 python a1.py
root      8278  6149  0 07:45 pts/3    00:00:00 grep --color=auto -i python
[root@master ~]# lsof -p 7565|grep elink
python  7565 root    3w   REG  253,0      1986 136764231 /var/log/elink.log.1

[root@master ~]# lsof -p 7195|grep elink
filebeat 7195 root    9r      REG              253,0      3051 136764231 /var/log/elink.log.1
[root@master ~]# 

filebeat 日志切割后不影响,直接读源文件就行