change default file_completed_action behavior in read mode

[inqueue]

When in read mode, file_completed_action defaults to delete which means data can be lost. Can we please consider changing this default behavior? Requiring explicit configuration to delete processed files is much more preferable.

• Version: 6.5.1
• Config File:

input {
  file {
    path => [ "/var/log/some-log.json" ]
    codec => "json"
    mode => "read"
    sincedb_path => "/dev/null"
    file_completed_log_path => "/Users/jbryan/stack/support-help-issues/issues.log"
  }
}

[danhermann]

I am also encountering users who are surprised and/or confused that their input files are being deleted, often because they are unaware of the default setting for file_completed_action.

[gypark]

Hello, Is there any new information about this?

I totally agree with @inqueue. I was very surprised just minutes ago, when I realized I had come to delete my original data