I'm running Filebeat (used to be know as "logstash-forwarder") on a docker container using prima/filebeat image.
The log files are located in a volume loaded to the container and I want to be able to remove the container and rerun it without it re-sending the logs to the logstash.
I tried to load the /.filebeat registry file as a volume so it will be reloaded on startup but all I get are these errors:
2016/02/03 13:47:29.107457 file_other.go:39: ERR Rotate error: rename /.filebeat.new /.filebeat: device or resource busy
2016/02/03 13:47:29.107788 registrar.go:105: ERR Writing of registry returned error: rename /.filebeat.new /.filebeat: device or resource busy. Continuing..
Does anybody happen to know how to do such a thing?