FSChange: fullEvent=true but no full event?

[muebel]

I have a fschange stanza configured as such

[fschange:/path/to/file]
disabled = false
pollPeriod = 300
fullEvent = true
hashMaxSize = 65535

It seems to be detecting changes to this file, but doesn't include the file as I am expecting fullEvent = true would do. What am I missing?

[Simeon · Accepted solution]

If something changed, you should see the file displayed depending on the search criteria. The best way to find it would be to search for:

index=* source=/path/to/file*

I would be curious to know the exact fschangemonitor output when you run your initial search. Additionally, you may have the sendEventMaxSize set to something too low. If you set it to -1 under the stanza, it should pick up the file:

sendEventMaxSize=-1

[muebel]

I misunderstood how this was working out... did a search for the file as a source, and was able to see the full file there.

[muebel]

sendEventMaxSize defaults to -1