We have a need to move our inputs for blob storage logs to a different forwarder. The problem is there is no way to define a time stamp to start ingestion from. So if we configure or re-configure the input it will start fresh and re-ingest ALL logs from that blob again. My question is how does the app maintain state to know what has been ingested and what has not?
i know this has been awhile. Did you ever find a solution? I has the same scenario.
It has been a long time since I have looked at it but there are some meta-data files that maintain where it left off. If you look in app metadata folders you should be able to find it.