Hi,
I'm using the UDP input in filebeat for collecting logs, and I'm seeing it periodically errors like this:
2024-02-08T12:48:19.399-0700 WARN [input.udp] map[file.line:251 file.name:udp/input.go function:github.com/elastic/beats/v7/filebeat/input/udp.(*inputMetrics).poll] failed to get udp stats from /proc: failed to parse rx_queue: strconv.ParseInt: parsing "0000E000": invalid syntax {"ecs.version": "1.6.0"}
This is with Filebeat version 8.12.0
I didn't experience this error with Filebeat version 7.17 (I don't recall which subversion).
I've manually created a go program and copy/pasted the offending values into strings and cannot re-create the error outside of Filebeat. These errors occur multiples of 60 seconds apart (I assume with the UDP statistics collection interval). Most of the time it's 2 minutes between error reports, but I've seen intervals as high as 14 minutes between errors. Over the course of 104 hours, I've seen 3000+ errors like this logged.
Given that the strings look like valid hexadecimal values, I suspect some type of data corruption is happening, but have no guesses as to what. After restarting filebeat, I saw the first of these errors within 5 minutes.
Thoughts?
Thanks,
- Daniel