# Filebeat 5.0alpha3/4 doesn't clean registry and crashes **URL:** \ **Category:** Beats\ **Tags:** filebeat\ **Created:** [August 2, 2016, 7:29am UTC](https://discuss.elastic.co/t/filebeat-5-0alpha3-4-doesnt-clean-registry-and-crashes/56971 "2016-08-02T07:29:12Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![Gabry993](https://avatars.discourse-cdn.com/v4/letter/g/96bed5/32.png) [@Gabry993](https://discuss.elastic.co/u/Gabry993)\ **Post date:** [August 2, 2016, 7:29am UTC](https://discuss.elastic.co/t/filebeat-5-0alpha3-4-doesnt-clean-registry-and-crashes/56971/1 "2016-08-02T07:29:12Z")
Hi, I'm facing a couple of problem when running filebeat (both alpha 3 and 4) on a windows server 2003. I'm trying to send the content of a log file which is written continuously and it's rotated often. This is how the rotation works: after reaching a certain size, the file "logxxx.log" get renamed in "logxxx-timestamp.log" and a new "logxxx.log" is created. As the file is rotated very often (and I am only on testing, the real environment creates a lot of log file with the same logic) I would like to controll the registry size, so this is my prospector config: ``` - input_type: log # Paths that should be crawled and fetched. Glob based paths. paths: #- /var/log/*.log - yyy\logxxx.log exclude_lines: ["^\\s*$"] include_lines: ["^([a-z]|[A-Z])"] ignore_older: 1m document_type: log_xxx registry: clean_inactive: 2m ``` I'm not sure if this is a working config, but I tried everything! The registry won't be cleaned, even if in the log file of filebeat I found many entries like these: > DBG State removed for yyy\logxxx.log because of older: %!s(MISSING) Moreover, after running for a couple of hour, filebeat crashes and I get this error which I can't understand, but I guess is related with the registry clean up: ``` panic: runtime error: slice bounds out of range goroutine 16 [running]: panic(0x8c3a80, 0x1125a010) /usr/local/go/src/runtime/panic.go:481 +0x326 github.com/elastic/beats/filebeat/input/file.(*States).Cleanup(0x113b6f60, 0xf84 75800, 0xd) /go/src/github.com/elastic/beats/filebeat/input/file/state.go:93 +0x388 github.com/elastic/beats/filebeat/prospector.(*ProspectorLog).Run(0x113b37c0) /go/src/github.com/elastic/beats/filebeat/prospector/prospector_log.go:5 3 +0x84 github.com/elastic/beats/filebeat/prospector.(*Prospector).Run(0x113b8420) /go/src/github.com/elastic/beats/filebeat/prospector/prospector.go:129 + 0x290 github.com/elastic/beats/filebeat/crawler.(*Crawler).Start.func1(0x113de0f0, 0x0 , 0x113b8420) /go/src/github.com/elastic/beats/filebeat/crawler/crawler.go:71 +0x102 created by github.com/elastic/beats/filebeat/crawler.(*Crawler).Start /go/src/github.com/elastic/beats/filebeat/crawler/crawler.go:72 +0x41d ``` And these are the last filebeat log lines: > 2016-08-01T18:27:41+02:00 INFO Registry file updated. 94 states written. > 2016-08-01T18:27:41+02:00 INFO Run prospector > 2016-08-01T18:27:41+02:00 DBG Start next scan > 2016-08-01T18:27:41+02:00 DBG Check file for harvesting: yyy\logxxx.log > 2016-08-01T18:27:41+02:00 DBG Update existing file for harvesting: yyy\logxxx.log, offset: 1350352 > 2016-08-01T18:27:41+02:00 DBG No updates needed, file yyy\logxxx.log is already harvested. > 2016-08-01T18:27:41+02:00 DBG State removed for yyy\logxxx.log because of older: %!s(MISSING) > 2016-08-01T18:27:41+02:00 DBG State removed for yyy\logxxx.log because of older: %!s(MISSING) > 2016-08-01T18:27:41+02:00 DBG State removed for yyy\logxxx.log because of older: %!s(MISSING) Thank you for your attention! Gabriele ---
**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\ **Post date:** [August 2, 2016, 8:52am UTC](https://discuss.elastic.co/t/filebeat-5-0alpha3-4-doesnt-clean-registry-and-crashes/56971/2 "2016-08-02T08:52:06Z")
Two things here: - The clean\_\* options do not exist in alpha4 yet. 5.0.0-alpha5 should come out very soonish and it will include the options. As an alternative you can test the nightly builds: [https://beats-nightlies.s3.amazonaws.com/index.html?prefix=filebeat/](https://beats-nightlies.s3.amazonaws.com/index.html?prefix=filebeat/) But the log above shows that you were probably using a newer version? - Here you can find on how clean\_inactive can be configured: [https://www.elastic.co/guide/en/beats/filebeat/master/configuration-filebeat-options.html#\_clean\_inactive](https://www.elastic.co/guide/en/beats/filebeat/master/configuration-filebeat-options.html#_clean_inactive) No indentation below `registry` need. Check the full config as an example: [https://github.com/elastic/beats/blob/master/filebeat/filebeat.full.yml#L196](https://github.com/elastic/beats/blob/master/filebeat/filebeat.full.yml#L196) Can you please check the most recent builds to see if the problems persist? ---
**Author:** ![Gabry993](https://avatars.discourse-cdn.com/v4/letter/g/96bed5/32.png) [@Gabry993](https://discuss.elastic.co/u/Gabry993)\ **Post date:** [August 2, 2016, 9:35am UTC](https://discuss.elastic.co/t/filebeat-5-0alpha3-4-doesnt-clean-registry-and-crashes/56971/3 "2016-08-02T09:35:01Z")
I'm currently using the alpha4. I will try the nightly as soon as I can! Thank you! ---
**Author:** ![Gabry993](https://avatars.discourse-cdn.com/v4/letter/g/96bed5/32.png) [@Gabry993](https://discuss.elastic.co/u/Gabry993)\ **Post date:** [August 6, 2016, 9:10pm UTC](https://discuss.elastic.co/t/filebeat-5-0alpha3-4-doesnt-clean-registry-and-crashes/56971/4 "2016-08-06T21:10:16Z")
Everything went perfect with the nightly! Thank you for all your work and support! ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [August 23, 2016, 7:29am UTC](https://discuss.elastic.co/t/filebeat-5-0alpha3-4-doesnt-clean-registry-and-crashes/56971/5 "2016-08-23T07:29:19Z")
This topic was automatically closed after 21 days. New replies are no longer allowed.