Can we change Java heap memory in Filebeat? If yes, how and where do we change?

Chandana · February 19, 2019, 5:31am

Hi,

Our filebeat installed server gives Swap Usage CRITICAL most of the time.
Initially we used to restart the server, but we are trying for a solution for this.
We have a 20GB RAM for that server.
Do we have any option to increase or decrease the heap memory in filebeat server?

Does filebeat Cache? If we delete this cache do we loose any data? Will it effect any of the indices or the dashboards?

Any help is appreciated.

Many Thanks
Chandana.

warkolm · February 19, 2019, 5:53am

Filebeat is written in golang, it doesn't use a JVM.

Chandana · February 19, 2019, 7:11am

Many thanks for the reply @warkolm.

Can you also help me to understand this
Does filebeat Cache? If we delete this cache do we loose any data?

warkolm · February 19, 2019, 7:12am

Why do you think filebeat is the cause of this memory issue?

Chandana · February 19, 2019, 7:22am

Because, we are using that server only for filebeat. We do not have any other services installed in that server.

As I have mentioned we have 20GB of RAM, and filebeat is consuming all the memory.
I am here with attaching the screenshot.

I will be greatfull if you can help me to solve this.

Filebeat2

warkolm · February 19, 2019, 7:23am

Please don't post pictures of text, they are difficult to read and some people may not be even able to see them.

That looks to me like the OS is doing what it is supposed to be doing and caching files that applications want open. So it's not filebeat consuming things, it's the OS trying to be smart.

steffens · February 19, 2019, 9:28am

Filebeat version?

Can you share configuration?

What is the exact resident memory usage? The go runtime reserves an virtual address space, but these are normally not backed by physical pages.

Chandana · February 19, 2019, 9:43am

We are using Filebeat version 6.2.3
System Configuration : 20GB RAM, 4 core processor, RHEL 7.4 OS.

Here is a screen shot for the resident memory usage

Chandana · February 19, 2019, 10:37am

Apologies for posting the pictures of text.

Is there any way to close the open files, I mean the files which are opened by filebeat?

derekcal · March 5, 2019, 8:13pm

You can try tweaking with a few things within the filebeat configuration so that files dont stay opened with close_inactive? https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-log.html#filebeat-input-log-close-inactive

system · April 2, 2019, 8:22pm

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.