Beats behaviour

Elastic Stack Beats
1

Hello all. I got a very strange problem with the Kibana and I honestly don't know where to search...
So the overview is this:
Kibana server with topbeat, packetbeat and filebeat running
Once in a day, or 2 days, filebeat stops showing any results in the dashboard I made.
Restart to Kibana and all 3 beats is not giving any solution, as also the removing and adding beats back to the index patterns
Under the /0/indices folder every beat got its own folder for today and 3 days back. Older folders are deleted by the cronjob every day
Kibana server is Linux, and it monitors the JBOSS linux servers. Filebeat is used for analysing the logs of JBOSS servers
Can someone please help me to solve the issue?

Thanks in advance
Igor

2

Is there data in the indices? Take a look with _cat/indices.

3

Thanks for the answer. Yes, it is

4

Please don't post pictures of text, they are difficult to read and some people may not be even able to see them.

Also, use the APIs, not the filesystem. What does that API show you?

5

Sorry, will not do it again
The result:

-bash-4.1# curl 'localhost:9200/_cat/indices/twi*?v' health status index pri rep docs.count docs.deleted store.size pri.store.size

So it shows nothing as I assume

6

Then it looks like a beats issue.

Can you post your configs and versions?

7 
2016/06/06 08:08:22.355246 beat.go:107: INFO Init Beat: topbeat; Version: 1.0.1
2016/06/06 08:09:13.320334 beat.go:107: INFO Init Beat: filebeat; Version: 1.0.1
2016/06/06 08:09:46.564029 beat.go:107: INFO Init Beat: packetbeat; Version: 1.0.1

Config - you mean the .yml files?

8

Yes.

10

`filebeat:
prospectors:
-
paths:
- /opt/jboss/EAP/standalone/log/server.log
fields:
server: jboss

registry_file: /var/lib/filebeat/registry

output:
logstash:
hosts: ["badger:5018"]

shipper:

logging:
level: warning
to_files: true
to_syslog: false
files:
path: /var/log/filebeat
name: filebeat.log
keepfiles: 2
rotateeverybytes: 10485760 # = 10MB

interfaces:
device: any

protocols:
dns:
ports: [53]
include_authorities: true
include_additionals: true
http:
ports: [80, 8080, 8180, 8280, 8380]
hide_keywords: ['password']
memcache:
ports: [11211]

vi /etc/topbeat/topbeat.yml
input:
period: 10
procs: [".*"]

stats:
system: true
proc: true
filesystem: true

output:
logstash:
hosts: ["badger:5018"]

shipper:

logging:
to_syslog: false
to_files: true
files:
path: /var/log/topbeat
name: topbeat.log
rotateeverybytes: 10485760 # = 10MB
keepfiles: 2
level: warning
~

output:
logstash:
hosts: ["badger:5018"]

shipper:

logging:
to_files: true
to_syslog: false
files:
path: /var/log/packetbeat
name: packetbeat.log
rotateeverybytes: 10485760 # = 10MB
keepfiles: 2
level: warning

`

11

Mark, you here? :slight_smile:

12

please upgrade your beats to more recent release. Old versions have a known bug of beats not sending new events if logstash/network failed way too often.

1 Like