Logstash-forwarder keeps its state of which logs were parsed in ${chdir}/.logstash-forwarder. Currently the directory in which this file is randomized which means that be each run the previously parsed logs are parsed again which is not good. Wouldn't it be better to keepdir /var/lib/logstash-forwarder and chdir there so that the daemon restarts won't duplicate the logs?
commit 8ff07efe8002a7ee0545cac58e6ec9a78c7481d6 commit 7aed80ade65c805b946a3e064cc1619cbc5c3a30
Thanks. By the way, what was the idea behind state dir randomization?