[Filebeat] Improve documentation about file identifiers/device ID

[belimawr]

Filebeat by default uses a combination of inode and device ID to identify files on its registry, however in some cases the device ID can change during boot, leading to data duplication.

One of those cases is when using LVM according to Red Hat Enterprise documentation.

One know workaround for that is to set the file_identity to path as described on our documentation.

This issue is about better document this issue when using LVM.

[elasticmachine]

Pinging @elastic/elastic-agent-data-plane (Team:Elastic-Agent-Data-Plane)

[pierrehilbert]

@karenzone: could you please add this to your backlog?

[botelastic]

Hi!
We just realized that we haven't looked into this issue in a while. We're sorry!

We're labeling this issue as Stale to make it hit our filters and make sure we get back to it as soon as possible. In the meantime, it'd be extremely helpful if you could take a look at it as well and confirm its relevance. A simple comment with a nice emoji will be enough :+1.
Thank you for your contribution!

[geekpete]

Do the docs changes as part of #35734 satisfy this docs requirement?

[belimawr]

Do the docs changes as part of #35734 satisfy this docs requirement?

Maybe. This bit does help:

Enable this option if you're experiencing data loss or data duplication due to unstable file identifiers provided by the file system.

However my original thinking was to be more explicit about it in the main file identity section, mentioning the LVM issue instead of just being a small note in the fingerprint.

[kilfoyle]

@belimawr Sorry it took me so long to get to this! Here's a PR for the docs change: #37959

Please let me know if I understood things correctly. :-)