# Filbeat still OOMs?

**URL:** <https://discuss.elastic.co/t/filbeat-still-ooms/156211>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [November 11, 2018, 7:24pm UTC](https://discuss.elastic.co/t/filbeat-still-ooms/156211 "2018-11-11T19:24:50Z")\
**Posts on this page:** 1\
**Showing post:** 2

<div class="post-metadata">

**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\
**Post date:** [November 12, 2018, 10:39pm UTC](https://discuss.elastic.co/t/filbeat-still-ooms/156211/2 "2018-11-12T22:39:56Z")

</div>

I assume it's a continuation of this discussion? [Filebeat OOM](https://discuss.elastic.co/t/filebeat-oom/146736)

In the old issue the gc limit was at about 13.6GB, but the metrics here say the GC limit is at ~162MB.

Is filebeat restarted between the two log metrics? The `gc_next` value didn't really change much.

Can you post the complete oom killer log (also check /var/log/dmesg). Should start with `<name> invoked oom-killer`, contain some stats, a long table and finally have a line like `Killed process <pid>` with some extra stats.

If I read the logs correctly, then the value of `4002812` is total\_vm in 4KB (which can be quite big, as go runtime over-reserves virtual addressed, without yet allocating physical pages), and `3641509` is the rss in 4KB. The later value does not match the metrics as reported by filebeat, but then the timestamps do not add up.

For how long was filebeat running before it was killed?

---

_[View the full topic](https://discuss.elastic.co/t/filbeat-still-ooms/156211)._