Can we change Java heap memory in Filebeat? If yes, how and where do we change?


(Chandana Priya Sathavalli) #1

Hi,

Our filebeat installed server gives Swap Usage CRITICAL most of the time.
Initially we used to restart the server, but we are trying for a solution for this.
We have a 20GB RAM for that server.
Do we have any option to increase or decrease the heap memory in filebeat server?

Does filebeat Cache? If we delete this cache do we loose any data? Will it effect any of the indices or the dashboards?

Any help is appreciated.

Many Thanks
Chandana.


(Mark Walkom) #2

Filebeat is written in golang, it doesn't use a JVM.


(Chandana Priya Sathavalli) #3

Many thanks for the reply @warkolm.

Can you also help me to understand this
Does filebeat Cache? If we delete this cache do we loose any data?


(Mark Walkom) #4

Why do you think filebeat is the cause of this memory issue?


(Chandana Priya Sathavalli) #5

Because, we are using that server only for filebeat. We do not have any other services installed in that server.

As I have mentioned we have 20GB of RAM, and filebeat is consuming all the memory.
I am here with attaching the screenshot.

I will be greatfull if you can help me to solve this.

Filebeat2


(Mark Walkom) #6

Please don't post pictures of text, they are difficult to read and some people may not be even able to see them.

That looks to me like the OS is doing what it is supposed to be doing and caching files that applications want open. So it's not filebeat consuming things, it's the OS trying to be smart.


(Steffen Siering) #7

Filebeat version?

Can you share configuration?

What is the exact resident memory usage? The go runtime reserves an virtual address space, but these are normally not backed by physical pages.


(Chandana Priya Sathavalli) #8

We are using Filebeat version 6.2.3
System Configuration : 20GB RAM, 4 core processor, RHEL 7.4 OS.

Here is a screen shot for the resident memory usage

Filebeat1


(Chandana Priya Sathavalli) #9

Apologies for posting the pictures of text.

Is there any way to close the open files, I mean the files which are opened by filebeat?


#10

You can try tweaking with a few things within the filebeat configuration so that files dont stay opened with close_inactive? https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-log.html#filebeat-input-log-close-inactive