ERR File is falling under ignore_older before harvesting is finished. Adjust your close_* settings: api_1.log

Elastic Stack Beats
1

I am using filebeat 5.0

I am getting these error on filebeat log:

2016-11-09T14:17:32+01:00 ERR Failed to publish events caused by: read tcp 192.168.11.21:42549->: read: connection reset by peer
2016-11-09T14:17:32+01:00 INFO Error publishing events (retrying): read tcp 192.168.11.21:42549->xxxx: read: connection reset by peer
2016-11-09T14:17:32+01:00 ERR File is falling under ignore_older before harvesting is finished. Adjust your close_* settings: api_1.log
2016-11-09T14:17:42+01:00 ERR File is falling under ignore_older before harvesting is finished. Adjust your close_* settings: api_1.log
2016-11-09T14:17:47+01:00 INFO Non-zero metrics in the last 30s: libbeat.logstash.published_but_not_acked_events=1668 libbeat.logstash.publish.read_errors=1 libbeat.logstash.publish.write_bytes=318 libbeat.logstash.call_count.PublishEvents=1

2016-11-09T14:19:04+01:00 ERR Failed to publish events caused by: read tcp 192.168.11.21:42622->xxxx: i/o timeout
2016-11-09T14:19:04+01:00 INFO Error publishing events (retrying): read tcp 192.168.11.21:42622->xxxx: i/o timeout
2016-11-09T14:19:12+01:00 ERR File is falling under ignore_older before harvesting is finished. Adjust your close_* settings: api_1.log
2016-11-09T14:19:17+01:00 INFO Non-zero metrics in the last 30s: libbeat.logstash.published_and_acked_events=76 libbeat.logstash.publish.write_bytes=1499 libbeat.logstash.publish.read_errors=1 libbeat.logstash.published_but_not_acked_events=1592 libbeat.logstash.call_count.PublishEvents=1

IF i restart the service it start sending logs few minutes but stop sending new lines again.

Any ideas on the connections timeouts and anf file file failing under ignore_older.

2

The ignore_older messages are related to your output issues. If a file is not completely sent and not closed yet, ignore_older will not apply.

It seems like there are issues with the connection between your filebeat instance and Logstash. Do you see any errors on the Logstash side? Could you share your config file?

3

After restarting logstash and filebeat and removing registry file i am not getting the errors. Will let you know if i found them again.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.