I had been getting the error like below in my filebeat log:
2017-10-17T04:35:19-05:00 DBG Check file for harvesting: /var/log/secure
2017-10-17T04:35:19-05:00 DBG Update existing file for harvesting: /var/log/secure, offset: 60739
2017-10-17T04:35:19-05:00 DBG Harvester for file is still running: /var/log/secure
I have searched in this forum and in a thread it is mentioned to update the logstash plugins and that fixed the issue.
I have updated the plugins using the below command:
bin/logstash-plugin update
But that doesn't solved the issue and later I figured out that a simple typo mistake like adding a " in the filebeat.yml configuration file can trigger this error.
So I closely checked and in my case it was uncommenting the ssl.certificate_authorities line in the filebeat configuration.
So decided to post this topic to make all of you aware that commenting the ssl parameter or just a " in the end of any log file might have trigger this error.
Cheers,
Jino Joseph.