# Elasticagent - filebeat is still increasing memory

**URL:** <https://discuss.elastic.co/t/elasticagent-filebeat-is-still-increasing-memory/350211>\
**Category:** Beats\
**Created:** [January 2, 2024, 8:58am UTC](https://discuss.elastic.co/t/elasticagent-filebeat-is-still-increasing-memory/350211 "2024-01-02T08:58:11Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![secsec](https://avatars.discourse-cdn.com/v4/letter/s/73ab20/32.png) [@secsec](https://discuss.elastic.co/u/secsec)\
**Post date:** [January 2, 2024, 8:58am UTC](https://discuss.elastic.co/t/elasticagent-filebeat-is-still-increasing-memory/350211/1 "2024-01-02T08:58:12Z")

</div>

Hello,

we are using ELK 8.11 and we have figured out that after installing elastic agent on windows and linux machines, they are 2 processes filebeat that are still increasing/allocation RAM more and more RAM.

Even it was mentioned in the discussions below, this problem is still reoccuring.

> [@Filebeat: "memory leak" via filebeat.autodiscover and \>\>200.000 goroutines](https://discuss.elastic.co/t/filebeat-memory-leak-via-filebeat-autodiscover-and-200-000-goroutines/322082):
>
> Hi, we use filebeat (8.5.3) to scrape logs from kubernetes (1.24) nodes and send them to logstash (8.5.3). We have been doing this since filebeat 6.x and have adjusted the configs to the best of our knowledge during the migrations. Since the update from 7.17 to 8.5.x, we can see an increasing amount of memory usage in filebeat, until it hits the resource memory limit and gets restarted by k8s. We've allowed up to 6GB, which should be more then enough, but that gets used on a regular basis:

> [@Potential memory leak issue with filebeat and metricbeat](https://discuss.elastic.co/t/potential-memory-leak-issue-with-filebeat-and-metricbeat/334353):
>
> Since upgrading from ELK 7.17.1 to ELK 8.6.2 (and even with ELK 8.7.1) we are experiencing OOMKilled on filebeat and metricbeat pods. We had no issues with ELK 7.17.1. Increasing the resources allocations does not resolve the issue and simply delays the crash. This appears to be a memory leak issue with beats. State: Running Started: Thu, 25 May 2023 15:18:43 +0000 Last State: Terminated Reason: OOMKilled Exit Code: 137 Started: Th…

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [January 2, 2024, 11:13am UTC](https://discuss.elastic.co/t/elasticagent-filebeat-is-still-increasing-memory/350211/2 "2024-01-02T11:13:51Z")

</div>

> [@secsec](#):
>
> we are using ELK 8.11

What is the exact version you are running and what are the integrations that you are using?

---

<div class="post-metadata">

**Author:** ![secsec](https://avatars.discourse-cdn.com/v4/letter/s/73ab20/32.png) [@secsec](https://discuss.elastic.co/u/secsec)\
**Post date:** [January 2, 2024, 2:04pm UTC](https://discuss.elastic.co/t/elasticagent-filebeat-is-still-increasing-memory/350211/3 "2024-01-02T14:04:00Z")

</div>

It is 8.11.2

`dpkg -l | grep -E 'elasticsearch|logstash|filebeat|kibana' ii elasticsearch 8.11.2 amd64 Distributed RESTful search engine built for the cloud ii filebeat 8.11.2 amd64 Filebeat sends log files to Logstash or directly to Elasticsearch. ii kibana 8.11.2 amd64 Explore and visualize your Elasticsearch data ii logstash 1:8.11.2-1 amd64 An extensible logging pipeline`

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [January 2, 2024, 2:07pm UTC](https://discuss.elastic.co/t/elasticagent-filebeat-is-still-increasing-memory/350211/4 "2024-01-02T14:07:33Z")

</div>

Is the Elastic Agent also on version 8.11.2?

There was a memory leak issue on Metricbeat on versions prior 8.11, but it should have been [fixed](https://github.com/elastic/beats/issues/37142) on version 8.11.2

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 30, 2024, 2:08pm UTC](https://discuss.elastic.co/t/elasticagent-filebeat-is-still-increasing-memory/350211/5 "2024-01-30T14:08:16Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.