# Endpoint Filebeat memory 7.13.3 "rare event"

**URL:** <https://discuss.elastic.co/t/endpoint-filebeat-memory-7-13-3-rare-event/279759>\
**Category:** Elastic Security\
**Tags:** fleet\
**Created:** [July 27, 2021, 5:20pm UTC](https://discuss.elastic.co/t/endpoint-filebeat-memory-7-13-3-rare-event/279759 "2021-07-27T17:20:25Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![PublicName](https://avatars.discourse-cdn.com/v4/letter/p/74df32/32.png) [@PublicName](https://discuss.elastic.co/u/PublicName)\
**Post date:** [July 27, 2021, 5:20pm UTC](https://discuss.elastic.co/t/endpoint-filebeat-memory-7-13-3-rare-event/279759/1 "2021-07-27T17:20:25Z")

</div>

![image](https://us1.discourse-cdn.com/elastic/original/3X/f/4/f4f85c7e166700e5c82224fe4cd6d66965a4505d.png)

Minor bug with Filebeat and Endpoint. This is a rare event and only happened to 6 "known" machines out of 100.

Filebeat memory utilization consumed the remaining host memory after a policy change. Steps that created the issue. All settings will be in Fleet under the device policies.

1. Go to policy. Open.
2. Change to settings tab.
3. Uncheck File and Metrics for debug.
4. Save and wait for it to roll out.

The existing Filebeat instance from endpoint did not exit correctly which resulted in the log file backing up in memory waiting to connect to agent to send. Another instance started up with the new settings running concurrently. Force killing the instance of filebeat and the machine returns to normal.

Poking at the dev's for that memory max settings :-). you guys are awesome 7.13.3+ has been very stable so far.

---

<div class="post-metadata">

**Author:** ![ferullo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ferullo/32/74240_2.png) [@ferullo](https://discuss.elastic.co/u/ferullo)\
**Post date:** [July 28, 2021, 3:39pm UTC](https://discuss.elastic.co/t/endpoint-filebeat-memory-7-13-3-rare-event/279759/2 "2021-07-28T15:39:33Z")

</div>

Thanks for reporting this, especially for the reproduction steps, which help immensely. I filed a Github [issue](https://github.com/elastic/beats/issues/27108) to track this bug.

I'm glad to hear you're seeing good things with 7.13.3!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 25, 2021, 3:40pm UTC](https://discuss.elastic.co/t/endpoint-filebeat-memory-7-13-3-rare-event/279759/3 "2021-08-25T15:40:06Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.