Filebeat 6.2.3: Unable to create runner due to error: Can only start a prospector when all related states are finished: {Id: Finished:false Fileinfo:0xc420196b60 Source:/var/log/nginx/access.log

Elastic Stack Beats
1

Filebeat 6.2.3
Error on /var/log/filebeat/filebeat

Unable to create runner due to error: Can only start a prospector when all related states are finished: {Id: Finished:false Fileinfo:0xc420196b60 Source:/var/log/nginx/access.log Offset:169527 Timestamp:2018-04-25 12:22:05.087086821 +0200 CEST m=+932.461573499 TTL:-1ns Type:log FileStateOS:39185-2048}

filebeat config:

- type: log

  enabled: true

  # Paths that should be crawled and fetched. Glob based paths.
  paths:
    - /var/log/*.log
    - /var/log/nginx/*.log
    - /var/log/elasticsearch/*.log
  tags: ["sistema"]

Only generate errors for all files under /var/log/nginx/*.log
If I remove /var/log/nginx/error.log, then get error with /var/log/nginx/access.log and so on

Why only fails under nginx logs?

Note: I've installed on all client servers and not errors found, but when filebeat is installed on the same ELK server, I got the errors mentioned.

2

Hi,

sorry to ask you but I'm not able to understand that why you install filebeat on same(ELK) server even you can use the File plugin in logstash for the same.

Thanks,
Harsh Bajaj

3

My ignorance. Thanks, I will try File plugin.
Any way... is it normal that error on the ELK server?

4

Hi Javier Leal,

No, It's not normal. It should work we need to check the logs and config files for RCA.

Better you use logstash file plugin you don't need to install filebeat on same server as it will use extra system resources and memory.

Thanks,
Harsh Bajaj

5

Thanks @harshbajaj16 . File plugin worked for me :wink:

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.