Filebeat is currently active (running) and I can see it is harvesting logs:
Jan 15 06:23:53 elastic-nfs01 filebeat[42359]: 2020-01-15T06:23:53.431Z INFO [monitoring] log/log.go:145 Non-zero metrics in the last 30s {"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":12240,"time":{"ms":304}},"total":{"ticks":155340,"time":{"ms":3596},"value":155340},"user":{"ticks":143100,"time":{"ms":3292}}},"handles":{"limit":{"hard":4096,"soft":1024},"open":90},"info":{"ephemeral_id":"X","uptime":{"ms":1050108}},"memstats":{"gc_next":90491200,"memory_alloc":78941936,"memory_total":17877918144},"runtime":{"goroutines":406}},"filebeat":{"events":{"active":1,"added":15387,"done":15386},"harvester":{"open_files":82,"running":82}},"libbeat":{"config":{"module":{"running":0}},"output":{"events":{"acked":15386,"batches":308,"total":15386},"read":{"bytes":3567224},"write":{"bytes":10595024}},"pipeline":{"clients":10,"events":{"active":4117,"published":15386,"total":15386},"queue":{"acked":15386}}},"registrar":{"states":{"current":101,"update":15386},"writes":{"success":232,"total":232}},"system":{"load":{"1":0.03,"15":0.41,"5":0.19,"norm":{"1":0.0075,"15":0.1025,"5":0.0475}}}}}}
When I also look in /var/lib/filebeat/registry/filebeat/data.json, the timestamp is today, denoting the file is being harvested by Filebeat. So I'm really confused right now in regards to what is happening.
{"source":"/data/elastic-backup/logs/elastic-warmdata03/elastic-01_audit-2019-12-15.log","offset":18049495555,"timestamp":"2020-01-15T06:29:09.344601377Z","ttl":-1,"type":"log","meta":null,"FileStateOS":{"inode":238781751,"device":64769}}]