I have a server where logs are generated on daily basis in this format-
/ABC/DEF/XYZ/xyz17012022.zip /ABC/DEF/XYZ/xyz16012022.zip /ABC/DEF/XYZ/xyz15012022.zip
OR
/ABC/DEF/RST/rst17012022.gz /ABC/DEF/RST/rst16012022.gz /ABC/DEF/RST/rst15012022.gz
I am getting this error , every time when i am indexing the .gz, .tar or .zip file - "updated less than 10000ms ago, will not read it until it stops changing ; has stopped changing , will read it now."
This problem was earlier addressed in this post,
As suggested I have used " crcSalt = <SOURCE> " but I am still facing similar errors.
inputs.conf:
[monitor:///ABC/DEF/XYZ/xyz*.zip]
index= log_critical
disabled = false
sourcetype= Critical_XYZ
ignoreOlderThan = 2d
crcSalt = <SOURCE>
I've experienced the same situation. Batch Reader was reading another large zip file before the one waiting with the message, "updated less than 10000ms ago, will not read it until it stops changing ; has stopped changing , will read it now."
Just wait till Batch Reader finishes reading the other large files. Then, the one waiting should be read.