One of my servers running a universal forwarder is spitting out this message quite frequently:
02-04-2016 16:48:49.607 -0500 INFO WatchedFile - Resetting fd to re-extract header.
What is this telling me? Each file does have a header, which we ignore via the FIELD_HEADER_REGEX parameter. Is it telling me that the header is being extracted? (These files roll over quite a bit).
I imagine its just letting you know the file is being opened from the start again. Might be resulting from the crcSalt but I honestly don't know - just guessing.
Also worth noting that its an INFO log entry so its not necessarily telling you of a problem. Is there a larger issue you are trying to address and believe this to be a symptom of?
Headers from a csv files are also getting ingested while props and transforms are defined to discard the headers as per following configs:
[sourcetype]
REGEX = Username
DEST_KEY = queue
FORMAT = nullQueue
Username is my header.