Filebeat doesn't resume transmission to logstash after connection interruption

Elastic Stack Beats
1

Reporting this here since https://github.com/elastic/beats/issues/new told me to.

We have filebeat running on several (Ubuntu) servers and transmitting logs to logstash on another server (also Ubuntu) (logstash sends the parsed data to ElasticSearch for storage.)

There was a firewall issue and the filebeat nodes were unable to access the logstash server for a couple of days.

After the issue was fixed and the filebeat servers had access to the logstash server again they didn't resume sending data to logstash.

Restarting the filebeat service resumed transmission.

One of the nodes may have resumed transmission, altho I'm not sure if I just have restarted it at that time. This is why at a glance it looked like the data was transmitting for us. For the other nodes this was not noticed for some days, so we "lost" the rotated log data.

Filebeat version: 1.0.1 (I don't recall seeing in the change logs any changes related to this since this version)
Logstash version: 2.1.1
OS: Ubutnu 14.04 LTS

PS: Thanks forum admins for silly password requirements on sites I don't care about.

2

This is a known bug being fixed in filebeat 1.1.1. Pre 1.1.1, if connection is unreachable for too long time or connection get's lost too often there is a chance filebeat won't be able to reconnect to logstash.

1 Like
3

@steffens, great. So this is fixed in filebeat 1.1.2 already?

4

yes, fix is available since 1.1.1

1 Like