Filebeat Crash

[surendrakotte]

Hello All,

FileBeat [6.2.x] crashes, how to identify the reason/fix it?

Current config Filebeat write to ELastic search directly.

Thanks in advance!

[adrisr (Adrian Serrano)]

Hi,

In order to diagnose the crash it will be useful to have a look at the filebeat logs. Can you share them?

Also a little bit more information like the OS it is running on and the configuration (filebeat.yml)

Under Linux, logs are to be found at /var/log/filebeat and the configuration at /etc/filebeat/filebeat.yml

[Debashis (Debashis Mondal)]

Hi @surendrakotte,

To understand the logs of filebeat enable Debug log in filebeat.yml file

In "/etc/filebeat/filebeat.yml" add following configuration

logging.level: debug
logging.selectors: ["*"]

As per above you will get the Debug logs of Filebeat in /var/log/filebeat/filebeat

If you want to get more insight of debug logs of Filebeat then execute filebeat as per following

[root@filebeat] filebeat.sh -e -d "*"

Note : In this way you will get the detail debug log with dynamic source code trace information. I think it will help you to understand the problem and understand the internal logics of Filebeat more conveniently.