Filebeat-6.5.1 Registry is Never Cleaned

Elastic Stack Beats
1

Filebeat 6.5.1, Red Hat 4.4.7
my filebeat can not clean up registry,

Here is the my config:

filebeat.inputs:
- type: log
  enabled: true
  paths:
    - /vol/*.log
  encoding: utf-8
  exclude_files: ['.*gc.log$']
  multiline.pattern: ^[0-9]{10}\.[0-9]{3}[[:space:]]\[
  multiline.negate: true
  multiline.match: after
  multiline.timeout: 8s
  backoff: 2s
  max_backoff: 10s
  backoff_factor: 3
  close_inactive: 5m
  clean_inactive: 3h
  scan_frequency: 10s
  ignore_older: 2h
  close_removed: true
  clean_removed: true
  harvester_buffer_size: 16384
  max_bytes: 1485760
filebeat.config.modules:
  path: ${path.config}/modules.d/*.yml
  reload.enabled: false

setup.template.settings:
  index.number_of_shards: 1
  index.codec: best_compression
  _source.enabled: true

name: test
queue:
  mem:
    events: 4096 
    flush.min_events: 2048
    flush.timeout: 10s
max_procs: 1
setup.kibana:
setup.template.name: "test"
setup.template.pattern: "test-*"
output.elasticsearch:
  hosts: ["localhost:9200"]
  pipeline: "test-pipeline"
  index: "sms-%{+yyyy.MM.dd}"
processors:
  - add_host_metadata: ~
  - add_cloud_metadata: ~
  - drop_fields:
     fields: ["_type","_score","beat.version","host","prospector"]
logging.metrics.enabled: true
logging.metrics.period: 5m
logging.to_files: true
logging.files:
  path: 
  name: filebeat.log
  rotateeverybytes: 10485760 
  keepfiles: 7
  permissions: 0644

  redirect_stderr: true

pls help

2

Hello @396175371, Are you talking about Filebeat's own registry? It should be cleaned periodically and running filebeat with logging in debug mode should display a statement about cleaning states.

3

I want to know if the filebeat registration file still saves this information when the filebeat has no log output and exceeds the clean_inactive configuration time. Is it supposed to be empty after the clean_inactive time?

4

Exceeded the time of the clean_inactive configuration, why the contents of the registration file have not been emptied yet?

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.