we use csv to track app's performance. I added the csv to forwarder and keep monitoring it. The problem is that while app is running and keeping writing to the csv, however, only the few minutes at the beginning will be indexed but not the rest. If moved the whole file, while no more update, to another location, I can get everything indexed. Any suggestions?
inputs.conf
[monitor:../logs/performance.csv]
blacklist = -\d
index = test
sourcetype = csv
crcSalt = <SOURCE>
↧