Beat Stops Sending Events When Journal Rotates

The Journal beat service appears to stop ending log events after the journal is rotated.

-rw-r-----+ 1 root systemd-journal  16M Dec 13 13:10 system@662da6c735c64e5f98db920498125e8e-0000000001f1a3dc-00057ce953492eca.journal
-rw-r-----+ 1 root systemd-journal 8.0M Dec 13 13:47 system.journal

The last journalbeat log events happened about the same time:

|2018-12-13T13:10:57.612-0500|INFO|[input]|input/input.go:131|journalbeat successfully published 8 events|{"id": "513e85da-8030-4a17-91d7-908bb09759ab"}|
|---|---|---|---|---|---|
|2018-12-13T13:11:00.614-0500|INFO|[input]|input/input.go:131|journalbeat successfully published 2 events|{"id": "513e85da-8030-4a17-91d7-908bb09759ab"}|

This is on Ubuntu 16.04 with no explicit settings in the journal.conf file.

EDIT

The journal files referenced above are located /run/log/journal/~machine-id~

1 Like

See: https://github.com/elastic/beats/issues/9533

Also keep in mind that journalbeat is experimental as of 6.5