Does filebeat cache setting on service start?

We have filebeat 5.4.0 installed , it seems when we update the DNS record that points to our logstash servers the filebeat agent needs to be restarted before it will use the updated DNS record.

The hosts filebeat is installed on (mix of Ubuntu & RHEL) resolves the correct address when using the DNS name. But filebeat does not, until restart.

Can anyone tell me if filebeat caches the host entry from the filebeat.yml when it starts and if there is a refresh period if it does?

If it does not cache this entry has anyone seen this behavior?

Filebeat will keep the connection to Logstash established so it could be that Filebeat hasn't needed to connect since the DNS entry was changed. I don't know of any name lookup caching in the LS output code. You can debug the name lookups using the GODEBUG environment variable (see You can configure Go to log anytime it does a name resolution. You should see the Beat doing a lookup whenever it connects to LS.

Thank you for the information. It appears that filebeat was keeping the connection established. Once I stopped Logstash it connected to the new server.

This topic was automatically closed after 21 days. New replies are no longer allowed.