My access_logs files are not being pulled constantly. There are large gaps between the pulling of logs.
The logs are being updated within the server path (timestamp shows this), but they are not all being pulled. The source files being pulled tends to be inconsistent; on some occasions it will pull all the proper source files, on other occasions, it will pull 1-2 source files (all from same path).
![![alt text][1]][1]
I attached an image as well (for visual reference).
By the way, our inputs.conf file has a very basic setup:
[monitor:path*.log]
sourcetype =log
index = name
Any help would be greatly appreciated.
[1]: /storage/temp/217857-screenshot-2.png
↧