title: Logstash-Forwader 3.1 state file .logstash-forwarder not updating
body: <p>I am having an issue with Logstash-forwarder 3.1.1 on Centos 6.5 where the state file /.logstash-forwarder is not updating as information is sent to Logstash.</p>
  
  <p>I have found as activity is logged by logstash-forwarder the corresponding offset is not recorded in /.logstash-forwarder 'logrotate' file. The ./logstash-forwarder file is being recreated each time 100 events are recorded but not updated with data.  I know the file has been recreated because I changed permissions to test, and permissions are reset each time.</p>
  
  <p>Below are my configurations (With some actual data italicized/scrubbed):
  Logstash-forwarder 3.1.1
  Centos 6.5</p>
  
  <p>/etc/logstash-forwarder
  <em>Note that the "paths" key does contain wildcards</em></p>
  
  <pre><code>{
    "network": {
      "servers": [ "*server*:*port*" ],
      "timeout": 15,
      "ssl ca": "/*path*/logstash-forwarder.crt"
    },
    "files": [
      {
        "paths": [
          "/a/b/tomcat-*-*/logs/catalina.out"
         ],
        "fields": { "type": "apache", "time_zone": "EST" }
      }
     ]
  }
  </code></pre>
  
  <p>Per logstash instructions for Centos 6.5 I have configured the LOGSTASH_FORWARDER_OPTIONS value so it looks like the following:</p>
  
  <pre><code>LOGSTASH_FORWARDER_OPTIONS="-config /etc/logstash-forwarder -spool-size 100"
  </code></pre>
  
  <p>Below is the resting state of the /.logstash-forwarder logrotate file:</p>
  
  <pre><code>{"/a/b/tomcat-set-1/logs/catalina.out":{"source":"/a/b/tomcat-set-1/logs/catalina.out","offset":433564,"inode":*number1*,"device":*number2*},"/a/b/tomcat-set-2/logs/catalina.out":{"source":"/a/b/tomcat-set-2/logs/catalina.out","offset":18782151,"inode":*number3*,"device":*number4*}}
  </code></pre>
  
  <p>There are two sets of logs that this is capturing.   The offset has stayed the same for 20 minutes while activities have been occurred and sent over to Logstash.</p>
  
  <p>Can anyone give me any advice on how to fix this problem whether it be a configuration setting I missed or a bug?</p>
  
  <p>Thank you!</p>