Filebeat 6.0.0 spawns 3 identical processes when sudo-ed

[Haribo]

Hello,

I am using Filebeat to send my application logs to a remote Logstash.
While testing, I ran ps -aux | grep filebeat and I noticed that starting Filebeat effectively started 3 processes :

$ sudo filebeat -e -c /etc/filebeat/filebeat.yml -d "publish"

$ ps -aux | grep filebeat
root      2789  0.0  0.3  55732  3648 pts/0    S+   16:27   0:00 sudo filebeat -e -c /etc/filebeat/filebeat.yml -d publish
root      2790  0.0  0.2  11248  2956 pts/0    S+   16:27   0:00 /bin/bash /usr/bin/filebeat -e -c /etc/filebeat/filebeat.yml -d publish
root      2791  0.0  1.8 145304 18432 pts/0    Sl+  16:27   0:00 /usr/share/filebeat/bin/filebeat -path.home /usr/share/filebeat -path.config /etc/filebeat -path.data /var/lib/filebeat -path.logs /var/log/filebeat -e -c /etc/filebeat/filebeat.yml -d publish

Is that a normal behavior ?
I can't find any information about this.

Regards,
Haribo.

[pierhugues (Pier-Hugues Pellerin)]

Hello @Haribo,

What is happening is the following, I presume you have installed Filebeat from one of the packages.

When you run sudo filebeat -e it executes the bash script in /usr/bin/filebeat which spawn filebeat with the correct options to setup the environment, this will result in 2 different processes.

So in your case, It is normal to have 3.

The last line is a filebeat that was started from an init script

[Haribo]

Thank you @pierhugues !

Do you think I should run the complete command manually to avoid having the sudo filebeat -e process ?

[pierhugues (Pier-Hugues Pellerin)]

No, there is no need to run the complete command.

[Haribo]

Thanks for your help