logstash 采集的文件mv后

1.logstash


[oswatch@rce1 conf]$ cat test.conf
input {
     file {
       path=>["/tmp/test/test.log*"]
  }
}






output {
   stdout {
     codec=>rubydebug{}
    }
 }






2.python脚本:


[oswatch@rce1 conf]$ cat t1.py
#!/usr/bin/python
# -*- coding: UTF-8 -*-
import time
 
# 打开一个文件
with open('/tmp/test/test.log', 'w', buffering=1)as f:
    for i in range(100000):
        f.write(str(time.time()) + "\n")
        time.sleep(1)




[oswatch@rce1 test]$ ls -ltr
total 4
-rw-rw-r-- 1 oswatch oswatch 1628 May 28 11:12 test.log




[oswatch@rce1 conf]$ lsof -p 139250
COMMAND    PID    USER   FD   TYPE DEVICE