Error sending logs with filebeat


(marc) #1

Hello,

Suddently my logstash server has stopped receiving logs from filebeat (whatever the server was, not just one but all).
I think that the problem started when i had problems with my itnernet connection (where logstash server is placed).
It refused all connections from all servers.

Since then i don't receive logs from filebeat.

If i debug filebeat, it shows this:

2016/03/21 15:57:33.443842 prospector.go:259: DBG  Check file for harvesting: /opt/tomcat/logs/tomcat.2016-03-21.log
2016/03/21 15:57:33.443858 prospector.go:382: DBG  Update existing file for harvesting: /opt/tomcat/logs/tomcat.2016-03-21.log
2016/03/21 15:57:33.443869 prospector.go:425: DBG  Not harvesting, file didn't change: /opt/tomcat/logs/tomcat.2016-03-21.log
2016/03/21 15:57:53.291464 spooler.go:97: DBG  Flushing spooler because of timeout. Events flushed: 0
2016/03/21 15:57:58.311283 reader.go:138: DBG  End of file reached: /opt/tomcat/logs/tomcat.2016-03-21.log; Backoff now.

If i create a new file, it show like it wants to send the log but it can't.

2016/03/21 15:57:51.426776 client.go:90: DBG  connect
2016/03/21 15:57:51.450801 single.go:126: INFO Connecting error publishing events (retrying): dial tcp myip:5044: getsockopt: connection refused
2016/03/21 15:57:51.450815 single.go:152: INFO send fail
2016/03/21 15:57:51.450824 single.go:159: INFO backoff retry: 1m0s
2016/03/21 15:57:53.291464 spooler.go:97: DBG  Flushing spooler because of timeout. Events flushed: 0
2016/03/21 15:57:55.435732 reader.go:138: DBG  End of file reached: /opt/tomcat/logs/tomcat.test.log; Backoff now.

so 2 questions:
-why is filebeat not detecting changes in logs? can i "reset" filebeat?it seems like it has something in memory.
-Is it showing that the connection is not working, but it is...any aidea?


(Magnus B├Ąck) #2

2016/03/21 15:57:51.450801 single.go:126: INFO Connecting error publishing events (retrying): dial tcp myip:5044: getsockopt: connection refused

Whatever network problem you had doesn't seem to be fixed.


(system) #3