Hello I am running a new installation of filebeat 7.12.0. I was initially getting an ILM error and so had the indices removed for filebeats.
Now when I run the filebeat -e setup, it seems to run for ever. I let it go for an hour and watched the indices documents continue to grow and the storage size grow, I believe we have it capped at 50MB. I let it run for an entire hour and it is still going. I am only dumping CentOS /var/logs/*
I just keep seeing log/harvester
INFO [monitoring] log/log.go:144 Non-zero metrics in the last 30s {"monitoring": {"metrics": {"beat":{"cgroup":{"cpuacct":{"total":{"ns":95859173}},"memory":{"mem":{"usage":{"bytes":-1454080}}}},"cpu":{"system":{"ticks":360,"time":{"ms":38}},"total":{"ticks":1140,"time":{"ms":96},"value":1140},"user":{"ticks":780,"time":{"ms":58}}},"handles":{"limit":{"hard":1048576,"soft":1048576},"open":17},"info":{"ephemeral_id":"ba16b749-6a74-47c9-a102-34d0f09ea3de","uptime":{"ms":270135}},"memstats":{"gc_next":23937200,"memory_alloc":16485192,"memory_total":118674968,"rss":59359232},"runtime":{"goroutines":64}},"filebeat":{"events":{"active":1,"added":15,"done":14},"harvester":{"open_files":3,"running":3}},"libbeat":{"config":{"module":{"running":1}},"output":{"events":{"acked":14,"active":0,"batches":14,"total":14},"read":{"bytes":5140},"write":{"bytes":32088}},"pipeline":{"clients":3,"events":{"active":1,"published":15,"total":15},"queue":{"acked":14}}},"registrar":{"states":{"current":14,"update":14},"writes":{"success":14,"total":14}},"system":{"load":{"1":2.26,"15":2.55,"5":2.63,"norm":{"1":0.0628,"15":0.0708,"5":0.0731}}}}}}
Scrolling continuously, should I just let it continue. Is it because the filebeat indices where removed?
Thank you.