# filebeat:Frequently occurring "should have been dropped, but couldn't as state is not finished"

**URL:** <https://discuss.elastic.co/t/filebeat-frequently-occurring-should-have-been-dropped-but-couldnt-as-state-is-not-finished/334497>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [May 27, 2023, 10:25am UTC](https://discuss.elastic.co/t/filebeat-frequently-occurring-should-have-been-dropped-but-couldnt-as-state-is-not-finished/334497 "2023-05-27T10:25:21Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![micmeow](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/micmeow/32/119871_2.png) [@micmeow](https://discuss.elastic.co/u/micmeow)\
**Post date:** [May 27, 2023, 10:25am UTC](https://discuss.elastic.co/t/filebeat-frequently-occurring-should-have-been-dropped-but-couldnt-as-state-is-not-finished/334497/1 "2023-05-27T10:25:21Z")

</div>

Hello. If you know how fix that, lend me your wisdom.

I use filebeat to transfer logs to Logstash to Opensearch.  
When I checked the filebeat log, I found that the same log file transfer errors were occurring frequently.

I counldn't know the cause, so I tried to reproduce it in the verification environment, but it didn't succeed.

I would like to know if there is a way to improve it.  
I've considered restarting the filebeat process, but I'd like to be careful when doing so in the production environment.  
So, I would like to know how a way except restarting the proces.

Varsion:  
Filebeat 7.10.0

filebeat log：

```auto
2023-02-15T20:00:01.225+0900 ERROR file/states.go:125 State for /home/XXXX/XXXX/log/log.SAMPLE.BASH.20221030204209 should have been dropped, but couldn't as state is not finished.
2023-02-15T20:00:04.346+0900 ERROR file/states.go:125 State for /home/XXXX/XXXX/log/log.SAMPLE.BASH.20221030204209 should have been dropped, but couldn't as state is not finished.
2023-02-15T20:00:08.834+0900 ERROR file/states.go:125 State for /home/XXXX/XXXX/log/log.SAMPLE.BASH.20221030204209 should have been dropped, but couldn't as state is not finished.
2023-02-15T20:00:08.919+0900 ERROR file/states.go:125 State for /home/XXXX/XXXX/log/log.SAMPLE.BASH.20221030204209 should have been dropped, but couldn't as state is not finished.
2023-02-15T20:00:13.191+0900 ERROR file/states.go:125 State for /home/XXXX/XXXX/log/log.SAMPLE.BASH.20221030204209 should have been dropped, but couldn't as state is not finished.
2023-02-15T20:00:19.252+0900 ERROR file/states.go:125 State for /home/XXXX/XXXX/log/log.SAMPLE.BASH.20221030204209 should have been dropped, but couldn't as state is not finished.
2023-02-15T20:00:19.503+0900 ERROR file/states.go:125 State for /home/XXXX/XXXX/log/log.SAMPLE.BASH.20221030204209 should have been dropped, but couldn't as state is not finished.
2023-02-15T20:00:19.531+0900 ERROR file/states.go:125 State for /home/XXXX/XXXX/log/log.SAMPLE.BASH.20221030204209 should have been dropped, but couldn't as state is not finished.
2023-02-15T20:00:34.548+0900 ERROR file/states.go:125 State for /home/XXXX/XXXX/log/log.SAMPLE.BASH.20221030204209 should have been dropped, but couldn't as state is not finished.
2023-02-15T20:00:34.578+0900 ERROR file/states.go:125 State for /home/XXXX/XXXX/log/log.SAMPLE.BASH.20221030204209 should have been dropped, but couldn't as state is not finished.

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 27, 2023, 10:25am UTC](https://discuss.elastic.co/t/filebeat-frequently-occurring-should-have-been-dropped-but-couldnt-as-state-is-not-finished/334497/2 "2023-05-27T10:25:21Z")

</div>

OpenSearch/OpenDistro are AWS run products and differ from the original Elasticsearch and Kibana products that Elastic builds and maintains. You may need to contact them directly for further assistance.

(This is an automated response from your friendly Elastic bot. Please report this post if you have any suggestions or concerns :elasticheart: )

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 24, 2023, 12:25pm UTC](https://discuss.elastic.co/t/filebeat-frequently-occurring-should-have-been-dropped-but-couldnt-as-state-is-not-finished/334497/3 "2023-06-24T12:25:34Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.