Filebeat 7.6.1 - persistence of logs

Elastic Stack Beats
1

I am new to using ELK.

I have the following configuration:

Filebeat—>Logstash—>Elasticsearch—>Kibana.

I have the following questions

  1. When filebeat service is stopped while Logstash is still running and later when filebeat service is restarted, how does filebeat keep a track of the logs read already and from
    where it has to start ?

  2. When Logstash service is stopped while filebeat is running and later when Logstash service is restarted how the pending logs are sent to Logstash ?

  3. Do I need to follow a particular order to start the services ?

2

Found that I was running filebeat without disown command .

This can be closed.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.