I am trying to setup AWS cloud watch agent on one of our nodes in our cluster and unable to find the difference between start_of_file and end_of_file for initial_position configuration.
I created a log file tes1234.log and provided the below log configuration in awslogs.conf [/var/awslogs/etc/awslogs.conf] file
[test1234_log]
datetime_format = %Y-%m-%d %H:%M:%S
file = /var/xxx/log/test1234.log
buffer_duration = 5000
log_stream_name = test1234_log_stream
initial_position = start_of_file
log_group_name = xxx-test
After providing these information I started the agent and found that logstream test_1234 is created but when I change it to end_of_file I found that logstream is not getting created.
I unable to find the difference between start_of_file and end_of_fileand on which scenarios need to use what.Kindly help.
That setting lets you specify whether to consume the log file from the beginning, or whether to start from the end. This only applies to the very first time you start the agent, because once you start it the agent will save its own pointer on the file and will continue from that location if/when restarted.
You may want to choose "end_of_file" if you don't care about any old data at the time you install the agent for the very first time. If you'd like to upload all the data already accumulated in the file, then choose "start_of_file". The only downside of "start_from_file" is that the agent might take a while to upload the whole file and catch up to the tail.