After windows update Filebeat service stops immediately

Hello
Situation - After applying May updates on windows filebeat service is stopped after 1-second execution.
There are no errors in logs and the same trouble with version 7.7. I couldn't find any useful info in system events too. With command line - everything working fine - but service is stopped.

indent preformatted text by 4 spaces

2020-05-19T13:31:15.845Z	INFO	instance/beat.go:607	Home path: [C:\Program Files\Filebeat] Config path: [C:\Program Files\Filebeat] Data path: [C:\ProgramData\filebeat\data] Logs path: [C:\ProgramData\filebeat\logs]
2020-05-19T13:31:15.848Z	INFO	instance/beat.go:615	Beat ID: 87eb7487-4deb-4189-857f-e71c88fb4a41
2020-05-19T13:31:15.848Z	INFO	[beat]	instance/beat.go:903	Beat info	{"system_info": {"beat": {"path": {"config": "C:\\Program Files\\Filebeat", "data": "C:\\ProgramData\\filebeat\\data", "home": "C:\\Program Files\\Filebeat", "logs": "C:\\ProgramData\\filebeat\\logs"}, "type": "filebeat", "uuid": "87eb7487-4deb-4189-857f-e71c88fb4a41"}}}
2020-05-19T13:31:15.848Z	INFO	[beat]	instance/beat.go:912	Build info	{"system_info": {"build": {"commit": "f940c36884d3749901a9c99bea5463a6030cdd9c", "libbeat": "7.4.0", "time": "2019-09-27T07:45:42.000Z", "version": "7.4.0"}}}
2020-05-19T13:31:15.851Z	INFO	[beat]	instance/beat.go:915	Go runtime info	{"system_info": {"go": {"os":"windows","arch":"amd64","max_procs":2,"version":"go1.12.9"}}}
2020-05-19T13:31:15.856Z	INFO	[beat]	instance/beat.go:919	Host info	{"system_info": {"host": {"architecture":"x86_64","boot_time":"2020-05-18T14:07:02.58Z","name":"***","ip":"***","kernel_version":"10.0.14393.3686 (rs1_release.200504-1524)","mac":["00:50:56:89:26:d6","00:00:00:00:00:00:00:e0"],"os":{"family":"windows","platform":"windows","name":"Windows Server 2016 Standard","version":"10.0","major":10,"minor":0,"patch":0,"build":"14393.3686"},"timezone":"GMT","timezone_offset_sec":0,"id":"5f6831d6-5303-41c8-b754-d8ac4f4d4282"}}}
2020-05-19T13:31:15.858Z	INFO	[beat]	instance/beat.go:948	Process info	{"system_info": {"process": {"cwd": "C:\\Windows\\system32", "exe": "C:\\Program Files\\Filebeat\\filebeat.exe", "name": "filebeat.exe", "pid": 9500, "ppid": 556, "start_time": "2020-05-19T13:31:15.697Z"}}}
2020-05-19T13:31:15.858Z	INFO	instance/beat.go:292	Setup Beat: filebeat; Version: 7.4.0
2020-05-19T13:31:15.858Z	INFO	[index-management]	idxmgmt/std.go:178	Set output.elasticsearch.index to 'filebeat-7.4.0' as ILM is enabled.
2020-05-19T13:31:15.859Z	INFO	elasticsearch/client.go:170	Elasticsearch url: 
2020-05-19T13:31:15.859Z	INFO	[publisher]	pipeline/module.go:97	Beat name: ---
2020-05-19T13:31:15.861Z	INFO	instance/beat.go:422	filebeat start running.
2020-05-19T13:31:15.861Z	INFO	[monitoring]	log/log.go:118	Starting metrics logging every 30s
2020-05-19T13:31:15.861Z	INFO	registrar/registrar.go:145	Loading registrar data from C:\ProgramData\filebeat\data\registry\filebeat\data.json
2020-05-19T13:31:15.864Z	INFO	registrar/registrar.go:152	States Loaded from registrar: 17
2020-05-19T13:31:15.864Z	INFO	crawler/crawler.go:72	Loading Inputs: 2
2020-05-19T13:31:15.865Z	INFO	log/input.go:152	Configured paths: [C:\Program Files\Filebeat\logs\*]
2020-05-19T13:31:15.865Z	INFO	input/input.go:114	Starting input of type: log; ID: 15784530934734097329 
2020-05-19T13:31:15.879Z	INFO	log/harvester.go:251	Harvester started for file: C:\Program Files\Filebeat\logs\filebeat
2020-05-19T13:31:15.906Z	INFO	log/harvester.go:251	Harvester started for file: C:\Program Files\Filebeat\logs\filebeat.1
2020-05-19T13:31:15.940Z	INFO	log/harvester.go:251	Harvester started for file: C:\Program Files\Filebeat\logs\filebeat.2
2020-05-19T13:31:15.940Z	INFO	log/harvester.go:251	Harvester started for file: C:\Program Files\Filebeat\logs\filebeat.3
2020-05-19T13:31:16.003Z	INFO	log/input.go:152	Configured paths: [E:\Logs\IIS.Logfiles\*\*.log F:\Logs\IIS.Logfiles\*\*.log]
2020-05-19T13:31:16.003Z	INFO	input/input.go:114	Starting input of type: log; ID: 16587631983168119480 
2020-05-19T13:31:16.003Z	INFO	crawler/crawler.go:106	Loading and starting Inputs completed. Enabled inputs: 2
2020-05-19T13:31:16.023Z	INFO	cfgfile/reload.go:171	Config reloader started

hi @udbv, can you provide us with the list of updates, you can run wmic qfe list or Get-HotFix?
Does reverting the updates help running Filebeat with no issues?

Hi @MarianaD
Here is screenshoot from WSUS
[image]


P.S.This update affected Telegraf too.

Root cause was a dynatrace agent.Even if dynatrace service is stopped,filebeat service won’t start.
Affected version: 1.191.189
Version with fix: 1.193.170

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.