I am working on a docker for a universal forwarder. The docker worked well until I reconfigured it for automatic restart.
This forwarder monitors a file outside of the docker.
Now when I restart the docker, the forwarder (as far as I understand the system) will reread the whole file because there is no 'last-read-mark' in a newly build forwarder. Because of this I set followTail=1. Missing a few events in our scenario is not as bad as having all old events double. But now I do not get any events at all.
The file I am monitoring does not have very much traffic, only about 500 entries per day.
In internal index I found the following entries like this for my monitored file, but cannot interpret them : 07-11-2019 09:15:48.586 +0000 INFO Metrics - group=per_source_thruput, series="/dataqualityservices/logs/behaviour.log", kbps=0.02759523914898141, eps=0.09677234550875673, kb=0.85546875, ev=3, avg_age=0.6666666666666666, max_age=2