{"action":"closed","issue":{"url":"https://api.github.com/repos/elastic/beats/issues/2788","repository_url":"https://api.github.com/repos/elastic/beats","labels_url":"https://api.github.com/repos/elastic/beats/issues/2788/labels{/name}","comments_url":"https://api.github.com/repos/elastic/beats/issues/2788/comments","events_url":"https://api.github.com/repos/elastic/beats/issues/2788/events","html_url":"https://github.com/elastic/beats/issues/2788","id":183102058,"number":2788,"title":"tail_files should persist initial offset as end of file","user":{"login":"andrewkroh","id":4565752,"avatar_url":"https://avatars.githubusercontent.com/u/4565752?v=3","gravatar_id":"","url":"https://api.github.com/users/andrewkroh","html_url":"https://github.com/andrewkroh","followers_url":"https://api.github.com/users/andrewkroh/followers","following_url":"https://api.github.com/users/andrewkroh/following{/other_user}","gists_url":"https://api.github.com/users/andrewkroh/gists{/gist_id}","starred_url":"https://api.github.com/users/andrewkroh/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/andrewkroh/subscriptions","organizations_url":"https://api.github.com/users/andrewkroh/orgs","repos_url":"https://api.github.com/users/andrewkroh/repos","events_url":"https://api.github.com/users/andrewkroh/events{/privacy}","received_events_url":"https://api.github.com/users/andrewkroh/received_events","type":"User","site_admin":false},"labels":[{"id":294278645,"url":"https://api.github.com/repos/elastic/beats/labels/Filebeat","name":"Filebeat","color":"008000","default":false}],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":3,"created_at":"2016-10-14T17:06:22Z","updated_at":"2016-11-07T15:55:56Z","closed_at":"2016-11-07T15:55:56Z","body":"At startup Filebeat initializes the registry with info about the file that it opens (but this does not contain an offset so it’s left as 0). This is the expected behavior for `tail_files: false` as we do not want to advance the offset until some data has been read. But for `tail_files: true` my personal expectation is that it would initially write the offset as the end of the file, instead of 0, so that if Filebeat exits it can resume reading from that point.\n- Version: 1.3.1\n- Operating System: affects all\n- Steps to Reproduce:\n  - Delete .filebeat registry file.\n  - Write multiple lines of text to `out.log`.\n  - Start filebeat with `tail_file: true`.\n  - Stop filebeat.\n  - Read the .filebeat registry. It will have an offset of 0 because no events were written to the file while Filebeat was reading.\n\nConfig:\n\n```\nfilebeat:\n  prospectors:\n    - paths:\n        - out.log\n      input_type: log\n      tail_files: true\n      close_older: 1s\n```\n"}}
{"actor":{"display_login":"ruflin"}}