Filebeat handles rotation; tail does not

A shipper that follows a file by descriptor keeps reading the rotated-away file and never sees the new one; a shipper that reopens by name misses whatever was written between the rotation and the reopen. Filebeat tracks inodes and offsets in a registry.

filebeat.prospectors:
  - input_type: log
    paths: [/var/www/shop/storage/logs/*.json]
    json.keys_under_root: true
    fields: { service: shop, env: production }
    fields_under_root: true

registry_file: /var/lib/filebeat/registry

The registry is what makes a restart resume rather than re-ship or skip, and losing it means one or the other. keys_under_root promotes the JSON fields to the top level so they are queryable without a prefix. Adding the service and environment at the shipper is free here and expensive to infer later from the index.