Elasticagent - filebeat is still increasing memory

[secsec]

Hello,

we are using ELK 8.11 and we have figured out that after installing elastic agent on windows and linux machines, they are 2 processes filebeat that are still increasing/allocation RAM more and more RAM.

Even it was mentioned in the discussions below, this problem is still reoccuring.

Filebeat: "memory leak" via filebeat.autodiscover and >>200.000 goroutines

Hi, we use filebeat (8.5.3) to scrape logs from kubernetes (1.24) nodes and send them to logstash (8.5.3). We have been doing this since filebeat 6.x and have adjusted the configs to the best of our knowledge during the migrations. Since the update from 7.17 to 8.5.x, we can see an increasing amount of memory usage in filebeat, until it hits the resource memory limit and gets restarted by k8s. We've allowed up to 6GB, which should be more then enough, but that gets used on a regular basis: […

Potential memory leak issue with filebeat and metricbeat

Since upgrading from ELK 7.17.1 to ELK 8.6.2 (and even with ELK 8.7.1) we are experiencing OOMKilled on filebeat and metricbeat pods. We had no issues with ELK 7.17.1. Increasing the resources allocations does not resolve the issue and simply delays the crash. This appears to be a memory leak issue with beats. State: Running Started: Thu, 25 May 2023 15:18:43 +0000 Last State: Terminated Reason: OOMKilled Exit Code: 137 Started: Th…

[leandrojmp (Leandro Pereira)]

@secsec

we are using ELK 8.11

What is the exact version you are running and what are the integrations that you are using?

[secsec]

It is 8.11.2

dpkg -l | grep -E 'elasticsearch|logstash|filebeat|kibana' ii elasticsearch 8.11.2 amd64 Distributed RESTful search engine built for the cloud ii filebeat 8.11.2 amd64 Filebeat sends log files to Logstash or directly to Elasticsearch. ii kibana 8.11.2 amd64 Explore and visualize your Elasticsearch data ii logstash 1:8.11.2-1 amd64 An extensible logging pipeline

[leandrojmp (Leandro Pereira)]

Is the Elastic Agent also on version 8.11.2?

There was a memory leak issue on Metricbeat on versions prior 8.11, but it should have been fixed on version 8.11.2