I have multiple log files which are written in descending order. i.e contents of xyz.log.5 are written before contents of log xyz.log.4. The number of log files is unknown.
So, I'm using a wildcard to read files
input{
file{
path => "path/to/file/xyz.log.*"
......
......
}
}
But this is reading the files in ascending order. Reading in descending order is important because my logs contain time based events which span over multiple files and I'm calculating time intervals using elapsed filter. So, currently I'm getting incorrect time intervals as reading order is different.
Is there a way to force logstash to read in descending order?