TailFile

Description:

"Tails" a file, or a list of files, ingesting data from the file as it is written to the file. The file is expected to be textual. Data is ingested only when a new line is encountered (carriage return or new-line character or combination). If the file to tail is periodically "rolled over", as is generally the case with log files, an optional Rolling Filename Pattern can be used to retrieve data from files that have rolled over, even if the rollover occurred while NiFi was not running (provided that the data still exists upon restart of NiFi). It is generally advisable to set the Run Schedule to a few seconds, rather than running with the default value of 0 secs, as this Processor will consume a lot of resources if scheduled very aggressively. At this time, this Processor does not support ingesting files that have been compressed when 'rolled over'.

Additional Details...

Tags:

tail, file, log, text, source

Properties:

In the list below, the names of required properties appear in bold. Any other properties (not in bold) are considered optional. The table also indicates any default values, and whether a property supports the NiFi Expression Language.

Display NameAPI NameDefault ValueAllowable ValuesDescription
Tailing modetail-modeSingle file
  • Single file In this mode, only the one file indicated in the 'Files to tail' property will be watched by the processor. In this mode, the file may not exist when starting the processor.
  • Multiple files In this mode, the 'Files to tail' property accepts a regular expression and the processor will look for files in 'Base directory' to list the files to tail by the processor.
Mode to use: single file will tail only one file, multiple file will look for a list of file. In Multiple mode the Base directory is required.
File(s) to TailFile to TailPath of the file to tail in case of single file mode. If using multifile mode, regular expression to find files to tail in the base directory. In case recursivity is set to true, the regular expression will be used to match the path starting from the base directory (see additional details for examples).
Supports Expression Language: true (will be evaluated using variable registry only)
Rolling Filename PatternRolling Filename PatternIf the file to tail "rolls over" as would be the case with log files, this filename pattern will be used to identify files that have rolled over so that if NiFi is restarted, and the file has rolled over, it will be able to pick up where it left off. This pattern supports wildcard characters * and ?, it also supports the notation ${filename} to specify a pattern based on the name of the file (without extension), and will assume that the files that have rolled over live in the same directory as the file being tailed. The same glob pattern will be used for all files.
Post-Rollover Tail PeriodPost-Rollover Tail Period0 secWhen a file is rolled over, the processor will continue tailing the rolled over file until it has not been modified for this amount of time. This allows for another process to rollover a file, and then flush out any buffered data. Note that when this value is set, and the tailed file rolls over, the new file will not be tailed until the old file has not been modified for the configured amount of time. Additionally, when using this capability, in order to avoid data duplication, this period must be set longer than the Processor's Run Schedule, and the Processor must not be stopped after the file being tailed has been rolled over and before the data has been fully consumed. Otherwise, the data may be duplicated, as the entire file may be written out as the contents of a single FlowFile.
Base directorytail-base-directoryBase directory used to look for files to tail. This property is required when using Multifile mode.
Supports Expression Language: true (will be evaluated using variable registry only)
Initial Start PositionInitial Start PositionBeginning of File
  • Beginning of Time Start with the oldest data that matches the Rolling Filename Pattern and then begin reading from the File to Tail
  • Beginning of File Start with the beginning of the File to Tail. Do not ingest any data that has already been rolled over
  • Current Time Start with the data at the end of the File to Tail. Do not ingest any data thas has already been rolled over or any data in the File to Tail that has already been written.
When the Processor first begins to tail data, this property specifies where the Processor should begin reading data. Once data has been ingested from a file, the Processor will continue from the last point from which it has received data.
State LocationFile LocationLocal
  • Local State is stored locally. Each node in a cluster will tail a different file.
  • Remote State is located on a remote resource. This Processor will store state across the cluster so that it can be run on Primary Node Only and a new Primary Node can pick up where the last one left off.
Specifies where the state is located either local or cluster so that state can be stored appropriately in order to ensure that all data is consumed without duplicating data upon restart of NiFi
Recursive lookuptailfile-recursive-lookupfalse
  • true
  • false
When using Multiple files mode, this property defines if files must be listed recursively or not in the base directory.
Lookup frequencytailfile-lookup-frequency10 minutesOnly used in Multiple files mode. It specifies the minimum duration the processor will wait before listing again the files to tail.
Maximum agetailfile-maximum-age24 hoursOnly used in Multiple files mode. It specifies the necessary minimum duration to consider that no new messages will be appended in a file regarding its last modification date. This should not be set too low to avoid duplication of data in case new messages are appended at a lower frequency.
Reread when NUL encounteredreread-on-nulfalse
  • true
  • false
If this option is set to 'true', when a NUL character is read, the processor will yield and try to read the same part again later. (Note: Yielding may delay the processing of other files tailed by this processor, not just the one with the NUL character.) The purpose of this flag is to allow users to handle cases where reading a file may return temporary NUL values. NFS for example may send file contents out of order. In this case the missing parts are temporarily replaced by NUL values. CAUTION! If the file contains legitimate NUL values, setting this flag causes this processor to get stuck indefinitely. For this reason users should refrain from using this feature if they can help it and try to avoid having the target file on a file system where reads are unreliable.
Line Start PatternLine Start PatternA Regular Expression to match against the start of a log line. If specified, any line that matches the expression, and any following lines, will be buffered until another line matches the Expression. In doing this, we can avoid splitting apart multi-line messages in the file. This assumes that the data is in UTF-8 format.

This Property is only considered if the [Tailing mode] Property has a value of "Single file".
Pre-Allocated Buffer Sizepre-allocated-buffer-size65536 BSets the amount of memory that is pre-allocated for each tailed file.
Max Buffer SizeMax Buffer Size64 KBWhen using the Line Start Pattern, there may be situations in which the data in the file being tailed never matches the Regular Expression. This would result in the processor buffering all data from the tailed file, which can quickly exhaust the heap. To avoid this, the Processor will buffer only up to this amount of data before flushing the buffer, even if it means ingesting partial data from the file.

This Property is only considered if the [Line Start Pattern] Property has a value specified.

Relationships:

NameDescription
successAll FlowFiles are routed to this Relationship.

Reads Attributes:

None specified.

Writes Attributes:

NameDescription
tailfile.original.pathPath of the original file the flow file comes from.

State management:

ScopeDescription
LOCAL, CLUSTERStores state about where in the Tailed File it left off so that on restart it does not have to duplicate data. State is stored either local or clustered depend on the <File Location> property.

Restricted:

Required PermissionExplanation
read filesystemProvides operator the ability to read from any file that NiFi has access to.

Input requirement:

This component does not allow an incoming relationship.

System Resource Considerations:

None specified.