We have filebeat 5.4.0 installed , it seems when we update the DNS record that points to our logstash servers the filebeat agent needs to be restarted before it will use the updated DNS record.
The hosts filebeat is installed on (mix of Ubuntu & RHEL) resolves the correct address when using the DNS name. But filebeat does not, until restart.
Can anyone tell me if filebeat caches the host entry from the filebeat.yml when it starts and if there is a refresh period if it does?
If it does not cache this entry has anyone seen this behavior?
Filebeat will keep the connection to Logstash established so it could be that Filebeat hasn't needed to connect since the DNS entry was changed. I don't know of any name lookup caching in the LS output code. You can debug the name lookups using the GODEBUG environment variable (see https://golang.org/pkg/net/#hdr-Name_Resolution). You can configure Go to log anytime it does a name resolution. You should see the Beat doing a lookup whenever it connects to LS.
Thank you for the information. It appears that filebeat was keeping the connection established. Once I stopped Logstash it connected to the new server.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.