More than one file has the same fingerprint.

[dss010101]

Im seeing a ton of these for our logs...and i would like to understand it a bit better.

My understanding from reading the docs is that the default fingerprint strategy is checksum...and that this means a portion of the file is used for that purpose.
Does this mean the file will be skipped?
Is there a way to avoid that not being so, since in fact there is content in these files we check to insure every run was successful?

file_server: file_source::file_server: More than one file has the same fingerprint.
Switching to watch most recently modified file

[jszwedko]

Hi @dss010101 !

That does indicate that Vector will skip one of the files. You can see the different fingerprint options here: https://vector.dev/docs/reference/configuration/sources/file/#fingerprint . Increasing the number of lines used for fingerprinting might avoid that issue.