DevOps Tools Engineer (LPIC-OT 701) — Question 20

A recently installed application writes log data to /opt/app/log/info.log. If Filebeat is already installed and set up for communication with a remote Logstash, what has to be done in order to submit the log data of the new application to Logstash?

Answer options

• A. Add an additional input channel with the option source => "/opt/app/log/info.log" to the Logstash configuration.
• B. Configure logrotate to execute filebeat ""I /opt/app/log/info.log 0 after each rotation of /opt/app/log/info.log.
• C. Add the log file to the path option within the log prospector in the Filebeat configuration and restart Filebeat.
• D. Add a new cron job that invokes filebeat ""i /opt/app/log/info.log periodically.
• E. Replace /opt/app/log/info.log by a symbolic link to /dev/filebeat and restart the new application.

Correct answer: E

Explanation

The correct answer E is valid because creating a symbolic link to /dev/filebeat allows Filebeat to monitor the new log file directly. The other options either misconfigure Filebeat or do not properly link the log file to the Filebeat process, preventing the logs from being sent to Logstash.