We have our Heavy forwarder server monitoring a shared directory for proxy data log file provided by our proxy team.
We want to switch from monitoring a log in a shared directory on Heavy Forwarder
to monitoring logs on Syslog server.
Right now the data input is running on Heavy Forwarder but we already receiving the same data on our Syslogger server.
So we want to disable data input on HF and enable data input on Syslogger
How do avoid or minimize duplication of data during the switch of data input of the same data from heavy forwarder to syslogger?
We cannot use ignoreOlderThan in inputs.conf because ignoreOlderThan looks at the file's modification timestamp and our logs are getting appended constantly
↧