How Filebeat ensures that the log file is still correctly read when the log file is split (or rolled)

During peak traffic periods, there will always be missing log collection. After investigation, the matching rules are not appropriate, and the scan_frequency defaults to 10s. In these 10s, multiple files may be missed, resulting in missing collection.
close_inactive
This parameter specifies how long to close the file handle when the monitored file has not changed.The official recommendation is to set this parameter to a value larger than the maximum file update interval.For example, the file is updated every 5s at most, then set it to 1min.The default value is 5min.

scan_frequency
This parameter specifies how often (time interval) Filebeat searches for new files.When a new file is found to be created, Filebeat will start another harvester for it to monitor.The default is 10s.

Combining the above two mechanisms, when logback completes log cutting (ie renaming), the old harvester is still monitoring the renamed log file, but since the file will not be updated, it will be closed at the close_inactive time.After closing the harvester of this file.When the scan_frequency time expires, Filebeat will find that a new file appears in the directory, so it starts the harvester for the file to monitor.This ensures that the data can be transmitted without loss or weight when the log is cut.(Not heavy is achieved by saving the offset for each log file)