@gcuselloactually two first solution that come to my mind are 1-mount network disk 2- crontab but unfortunately neither approve by product owner. (they have some issue with these solution). as you mention copy file not good idea for large log file, specially they need realtime collection. I'm curious to know is there any solution like splunk forwarder exit for this scenario? work like this: server1 > server2 > centralize log server3 > FYI1: rsyslog, filebeat, syslog-ng, fluentd, ... are available solution but I can't decide which one is more suitable for this issue. FYI2: raw data is important , and doesn't be missed. (don't want to clean data exact log file is important for me) FYI3: like splunk forwarder whenever servers or network down, after issue resolve it will continuously send data. (AFAIK rsyslog use tracker file when server stopped and try to send remain file after service start again but while service down new file create with different name and structure can't track) (but splunk forwarder can handle this situation even when forwarder service on servers down, whenever start it can discover any file on that path) FYI4: here is the path of my log /opt/log/* different file, with different name may create here , I need to dynamically everything on this path send to the centralize log.
... View more