Have any of you had the necessity to use time_before_close in inputs.conf. if so could you share your scenario? I am having an issue with a source log where events could be quite large. Therefore, some events are not broken correctly.
Thanks, Lp
Have any of you had the necessity to use time_before_close in inputs.conf. if so could you share your scenario? I am having an issue with a source log where events could be quite large. Therefore, some events are not broken correctly.
Thanks, Lp