I am using telegraf for reading my logs, parsing it using a GROK pattern and then pushing the logs to influx. I use logparser plugin to tail and parse the logs and I have set the property from_beginning to false, which means the agent reads the logs from where it left off.
It worked fine until there was a Kernel update recently due to which my CentOS 7 machine had to reboot. Surprisingly I saw telegraf reading the log files from the beginning.
Is it because telegraf lost its file pointer after the Kernel update? Normal reboot without the Kernel update was working fine as expected.
Any insights would be much appreciated. I am using telegraf 1.12.4
I can’t think of how this might occur. We do store the offsets in memory in case Telegraf is reloaded, but they are not persisted to disk in case the service restarts. Can you reproduce the issue?
