We have a number of servers that run Filebeat as a service and the majority of them are having the same issue upon startup: “Error 1067: The process terminates unexpectedly.”
Here's the log file on first run:
2020-04-15T04:13:05.457-0500 INFO instance/beat.go:468 Home path: [C:\Program Files\Filebeat] Config path: [C:\Program Files\Filebeat] Data path: [C:\\ProgramData\\filebeat] Logs path: [C:\\ProgramData\\filebeat\logs]
2020-04-15T04:13:05.662-0500 INFO instance/beat.go:475 Beat UUID: dccfbeb5-ec0a-45e7-9079-b2455d29f3ca
2020-04-15T04:13:05.662-0500 INFO instance/beat.go:213 Setup Beat: filebeat; Version: 6.2.3
2020-04-15T04:13:05.671-0500 INFO elasticsearch/client.go:145 Elasticsearch url: http://logs.lwolf.com:80
2020-04-15T04:13:05.692-0500 INFO pipeline/module.go:76 Beat name: DAL-HOST2
2020-04-15T04:13:06.055-0500 INFO instance/beat.go:301 filebeat start running.
2020-04-15T04:13:06.062-0500 INFO [monitoring] log/log.go:97 Starting metrics logging every 30s
2020-04-15T04:13:06.087-0500 INFO registrar/registrar.go:108 Loading registrar data from C:\ProgramData\filebeat\registry
2020-04-15T04:13:06.091-0500 INFO instance/beat.go:308 filebeat stopped.
We've removed the C:\ProgramData\filebeat directory on a number of them, here's the log file after doing that:
2020-04-24T09:38:35.169-0500 INFO instance/beat.go:468 Home path: [C:\Program Files\Filebeat] Config path: [C:\Program Files\Filebeat] Data path: [C:\\ProgramData\\filebeat] Logs path: [C:\\ProgramData\\filebeat\logs]
2020-04-24T09:38:35.175-0500 INFO instance/beat.go:475 Beat UUID: b43ff83d-b14b-449a-94fc-5237b087a54c
2020-04-24T09:38:35.175-0500 INFO instance/beat.go:213 Setup Beat: filebeat; Version: 6.2.3
2020-04-24T09:38:35.176-0500 INFO elasticsearch/client.go:145 Elasticsearch url: http://logs.lwolf.com:80
2020-04-24T09:38:35.177-0500 INFO pipeline/module.go:76 Beat name: DAL-HOST1
2020-04-24T09:38:35.180-0500 INFO instance/beat.go:301 filebeat start running.
2020-04-24T09:38:35.180-0500 INFO registrar/registrar.go:71 No registry file found under: C:\ProgramData\filebeat\registry. Creating a new registry file.
2020-04-24T09:38:35.180-0500 INFO [monitoring] log/log.go:97 Starting metrics logging every 30s
2020-04-24T09:38:35.184-0500 INFO registrar/registrar.go:108 Loading registrar data from C:\ProgramData\filebeat\registry
2020-04-24T09:38:35.184-0500 INFO registrar/registrar.go:119 States Loaded from registrar: 0
2020-04-24T09:38:35.184-0500 INFO crawler/crawler.go:48 Loading Prospectors: 1
2020-04-24T09:38:35.184-0500 INFO log/prospector.go:111 Configured paths: [C:\Program Files (x86)\BWExportService\logs\*.log D:\ClientData\*\LoneWolf\*\Performance_Logs\*.log]
2020-04-24T09:38:35.185-0500 INFO crawler/crawler.go:82 Loading and starting Prospectors completed. Enabled prospectors: 1
2020-04-24T09:38:35.185-0500 INFO cfgfile/reload.go:127 Config reloader started
2020-04-24T09:38:35.185-0500 INFO cfgfile/reload.go:219 Loading of config files completed.
We've reinstalled the service and application and still run into the same error. What could be causing this and how could we fix it?