Best practice for ingesting old log files

I’m curious to know if anyone is familiar with the best approach to ingest a number of old log files into Loki/Promtail?

My challenge is that the logs directory contains log files that cover a few months, with each log file rotating every hour, the file names look like this:

PROD_829636.esw3ccs_ghostip_S.202107120000-1200-0
PROD_829636.esw3ccs_ghostip_S.202107120000-1200-1
PROD_829636.esw3ccs_ghostip_S.202107120000-1200-2
PROD_829636.esw3ccs_ghostip_S.202107120000-1200-3
PROD_829636.esw3ccs_ghostip_S.202107120000-1200-4
etc…

I have Promtail configured to look for anything that matches PROD* in the path, and that works great if there’s a single log file in the directory. However, when a number of log files are present for the batch ingest, anything ingested that is chronologically older than the first ingested file is ignored since the timestamp is out of order.

Is there a way I can control the order in which log files are ingested?

This topic was automatically closed 365 days after the last reply. New replies are no longer allowed.