[logback-user] Log events delivery guarantee.

[Oleksandr Gavenko]

On Fri, Jun 2, 2017 at 8:01 PM, Oleksandr Gavenko <gavenkoa at gmail.com> wrote:
>
> Alternative approach is to write log and later parse it. Like this
> done with Filebeat https://www.elastic.co/products/beats/filebeat that
> complement to ElasticSearch.
>
> The problem with such solution is necessity to invent or follow file
> format. Formatting log with MDC and Markers that can be tricky.
>
What I forgot to add is that parsing stack traces with filebeat is not
a pleasure.

Also it's tricky to manage file rotation, from
https://discuss.elastic.co/t/will-filebeat-handle-properly-the-underlying-log-file-rotation/56119/4

> while filebeat uses file metadata like inode and device id in order to track files, it still requires the full path in order to open files.
> The prospectors can only find files by path and do check inode/device id against known set of inodes.

> If a file is simply renamed or closed by the logger, but still open by filebeat,
> filebeat will process until end (will not close file handle yet).
> But if filebeat gets restarted in between, it needs to find the renamed files again.
> In order to find renamed files, the glob pattern must match rotated files too. So to say, it's better use pattern mysqld.log*.

That is not reliable solution in my view.