Reread a log file from the beginning

[monegim]

Is there a way to have mtail start reading from the beginning of a log file again? For instance, if the seeker is currently at line 234, is there a way to reset the seeker to 0 so that it starts reading from the beginning of the file?

[jaqx0r]

I am not sure what you want to do here.

The simple answer is no, mtail is for reading log lines as they arrive and turning them into metrics. There is no way to manually reset the read offset.

A slightly more complex answer is, yes, if the log file it is reading gets truncated and is restarted by the log writer, mtail will notice this and start again from offset 0.

If you are experimenting, then the --one_shot command line flag will tell mtail to read from the start of the file, but this flag also tells mtail to exit at the end of the file.

[monegim]

I was considering using mtail as a static file reader to convert specific fields into metrics.
Imagine there is a process that periodically writes all its metrics into a file with a consistent pattern. My goal is to regularly read this file and expose the metrics. However, I am unsure if mtail is capable of handling this type of periodic file reading and metric extraction.

[jaqx0r]

It'll half-work, I think.

When mtail starts, it'll go to EOF to start reading "new" log lines. So the current fields won't be read.

Depending on how the file is rewritten it might work well or go badly:

• If you write a new file and then rename it over the top of the old one, you'll have a new inode and mtail will notice and start at zero to read the new file.
• If you truncate the current file and write over it, mtail will notice if the file offset is lower than the current position. Assuming you write mostly the same amount each time, this is probably going to end up with random successes and failures to read the new file.

If you append your data to the file it'll just work because that's how logs tend to go.

We could add a new flag that says this is not a log file, but a status file, and change the reader behaviour to cope with this mechanism.

[monegim]

We could add a new flag that says this is not a log file, but a status file, and change the reader behaviour to cope with this mechanism.

Great, thank you for the information. Should I contribute to the development of this feature, or is it already planned for a future release?

[jaqx0r]

This is not planned. You may send me some PRs if you like.