Hello,
I am using Filebeat to send my application logs to a remote Logstash.
While testing, I ran ps -aux | grep filebeat and I noticed that starting Filebeat effectively started 3 processes :
$ sudo filebeat -e -c /etc/filebeat/filebeat.yml -d "publish"
$ ps -aux | grep filebeat
root 2789 0.0 0.3 55732 3648 pts/0 S+ 16:27 0:00 sudo filebeat -e -c /etc/filebeat/filebeat.yml -d publish
root 2790 0.0 0.2 11248 2956 pts/0 S+ 16:27 0:00 /bin/bash /usr/bin/filebeat -e -c /etc/filebeat/filebeat.yml -d publish
root 2791 0.0 1.8 145304 18432 pts/0 Sl+ 16:27 0:00 /usr/share/filebeat/bin/filebeat -path.home /usr/share/filebeat -path.config /etc/filebeat -path.data /var/lib/filebeat -path.logs /var/log/filebeat -e -c /etc/filebeat/filebeat.yml -d publish
Is that a normal behavior ?
I can't find any information about this.
Regards,
Haribo.