Filebeat getting stop without giving any error

Hi everybody,

I have a situation where filebeat automatically gets toped without giving any error in the log file. I am attaching all the logs of the filebeat. I am reading multiple files from the same path. Data in files vary in each file.
Any suggestions and help would be appreciated.

2020-07-13T21:09:12.367+0500 INFO [monitoring] log/log.go:145 Non-zero metrics in the last 30s {"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":40750,"time":{"ms":196}},"total":{"ticks":101600,"time":{"ms":338},"value":101600},"user":{"ticks":60850,"time":{"ms":142}}},"handles":{"limit":{"hard":65535,"soft":65535},"open":20},"info":{"ephemeral_id":"9ae89486-06fd-4361-a484-8af7d1abfe88","uptime":{"ms":7770079}},"memstats":{"gc_next":25924992,"memory_alloc":18995296,"memory_total":15710805560},"runtime":{"goroutines":125}},"filebeat":{"events":{"active":4,"added":136,"done":132},"harvester":{"files":{"26b1083b-fa65-4b8c-b54f-998b998273ed":{"last_event_published_time":"2020-07-13T21:09:12.236Z","last_event_timestamp":"2020-07-13T21:09:12.236Z","read_offset":1088928,"size":951231}},"open_files":3,"running":3}},"libbeat":{"config":{"module":{"running":0}},"output":{"events":{"acked":132,"batches":27,"total":132},"read":{"bytes":162},"write":{"bytes":258804}},"pipeline":{"clients":12,"events":{"active":4,"published":136,"total":136},"queue":{"acked":132}}},"registrar":{"states":{"current":14,"update":132},"writes":{"success":27,"total":27}},"system":{"load":{"1":0.56,"15":0.63,"5":0.55,"norm":{"1":0.14,"15":0.1575,"5":0.1375}}}}}}
2020-07-13T21:09:42.367+0500 INFO [monitoring] log/log.go:145 Non-zero metrics in the last 30s {"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":40840,"time":{"ms":91}},"total":{"ticks":101890,"time":{"ms":287},"value":101890},"user":{"ticks":61050,"time":{"ms":196}}},"handles":{"limit":{"hard":65535,"soft":65535},"open":20},"info":{"ephemeral_id":"9ae89486-06fd-4361-a484-8af7d1abfe88","uptime":{"ms":7800078}},"memstats":{"gc_next":25733456,"memory_alloc":18838136,"memory_total":15770091504},"runtime":{"goroutines":125}},"filebeat":{"events":{"added":121,"done":121},"harvester":{"files":{"26b1083b-fa65-4b8c-b54f-998b998273ed":{"last_event_published_time":"2020-07-13T21:09:42.269Z","last_event_timestamp":"2020-07-13T21:09:42.269Z","read_offset":1082854,"size":1083841},"3e215e34-603b-4177-a26b-5e0505a27d4f":{"last_event_published_time":"2020-07-13T21:09:38.269Z","last_event_timestamp":"2020-07-13T21:09:38.269Z","read_offset":2256,"size":1269}},"open_files":3,"running":3}},"libbeat":{"config":{"module":{"running":0}},"output":{"events":{"acked":121,"batches":24,"total":121},"read":{"bytes":144},"write":{"bytes":251885}},"pipeline":{"clients":12,"events":{"active":4,"published":121,"total":121},"queue":{"acked":121}}},"registrar":{"states":{"current":14,"update":121},"writes":{"success":24,"total":24}},"system":{"load":{"1":0.34,"15":0.61,"5":0.5,"norm":{"1":0.085,"15":0.1525,"5":0.125}}}}}}
2020-07-13T21:09:54.393+0500 INFO [add_docker_metadata.docker] docker/watcher.go:328 No events received within 10m0s, restarting watch call
2020-07-13T21:10:12.367+0500 INFO [monitoring] log/log.go:145 Non-zero metrics in the last 30s {"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":40910,"time":{"ms":72}},"total":{"ticks":102140,"time":{"ms":255},"value":102140},"user":{"ticks":61230,"time":{"ms":183}}},"handles":{"limit":{"hard":65535,"soft":65535},"open":20},"info":{"ephemeral_id":"9ae89486-06fd-4361-a484-8af7d1abfe88","uptime":{"ms":7830079}},"memstats":{"gc_next":25920032,"memory_alloc":19468720,"memory_total":15820264328},"runtime":{"goroutines":125}},"filebeat":{"events":{"active":-3,"added":132,"done":135},"harvester":{"files":{"26b1083b-fa65-4b8c-b54f-998b998273ed":{"last_event_published_time":"2020-07-13T21:10:12.300Z","last_event_timestamp":"2020-07-13T21:10:12.300Z","read_offset":1085860,"size":1019542},"3e215e34-603b-4177-a26b-5e0505a27d4f":{"last_event_published_time":"2020-07-13T21:10:08.275Z","last_event_timestamp":"2020-07-13T21:10:08.275Z","read_offset":2256,"size":1974}},"open_files":3,"running":3}},"libbeat":{"config":{"module":{"running":0}},"output":{"events":{"acked":135,"batches":19,"total":135},"read":{"bytes":114},"write":{"bytes":250402}},"pipeline":{"clients":12,"events":{"active":1,"published":132,"total":132},"queue":{"acked":135}}},"registrar":{"states":{"current":14,"update":135},"writes":{"success":19,"total":19}},"system":{"load":{"1":0.26,"15":0.59,"5":0.47,"norm":{"1":0.065,"15":0.1475,"5":0.1175}}}}}}
2020-07-13T21:10:42.370+0500 INFO [monitoring] log/log.go:145 Non-zero metrics in the last 30s {"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":41040,"time":{"ms":128}},"total":{"ticks":102560,"time":{"ms":418},"value":102560},"user":{"ticks":61520,"time":{"ms":290}}},"handles":{"limit":{"hard":65535,"soft":65535},"open":20},"info":{"ephemeral_id":"9ae89486-06fd-4361-a484-8af7d1abfe88","uptime":{"ms":7860078}},"memstats":{"gc_next":25227408,"memory_alloc":14633392,"memory_total":15871910648},"runtime":{"goroutines":125}},"filebeat":{"events":{"active":-1,"added":570,"done":571},"harvester":{"files":{"26b1083b-fa65-4b8c-b54f-998b998273ed":{"last_event_published_time":"2020-07-13T21:10:42.336Z","last_event_timestamp":"2020-07-13T21:10:42.336Z","read_offset":1080043,"size":1013584},"3e215e34-603b-4177-a26b-5e0505a27d4f":{"last_event_published_time":"2020-07-13T21:10:39.281Z","last_event_timestamp":"2020-07-13T21:10:39.281Z","read_offset":2115,"size":2256},"a33b223b-fe29-41c0-bfda-936730cca7e1":{"last_event_published_time":"2020-07-13T21:10:22.340Z","last_event_timestamp":"2020-07-13T21:10:22.340Z","read_offset":60333,"size":60333}},"open_files":3,"running":3}},"libbeat":{"config":{"module":{"running":0}},"output":{"events":{"acked":568,"batches":18,"total":568},"read":{"bytes":108},"write":{"bytes":285405}},"pipeline":{"clients":12,"events":{"active":0,"filtered":3,"published":567,"total":570},"queue":{"acked":568}}},"registrar":{"states":{"current":14,"update":571},"writes":{"success":18,"total":18}},"system":{"load":{"1":0.51,"15":0.6,"5":0.5,"norm":{"1":0.1275,"15":0.15,"5":0.125}}}}}}
2020-07-13T21:11:05.927+0500 INFO beater/filebeat.go:449 Stopping filebeat
2020-07-13T21:11:05.927+0500 INFO beater/crawler.go:138 Stopping Crawler
2020-07-13T21:11:05.927+0500 INFO beater/crawler.go:148 Stopping 12 inputs
2020-07-13T21:11:05.927+0500 INFO cfgfile/reload.go:238 Dynamic config reloader stopped
2020-07-13T21:11:05.927+0500 INFO input/input.go:149 input ticker stopped
2020-07-13T21:11:05.927+0500 INFO input/input.go:149 input ticker stopped
2020-07-13T21:11:05.927+0500 INFO input/input.go:167 Stopping Input: 522834419397390746
2020-07-13T21:11:05.928+0500 INFO input/input.go:167 Stopping Input: 14196711778473463313
2020-07-13T21:11:05.928+0500 INFO input/input.go:149 input ticker stopped
2020-07-13T21:11:05.928+0500 INFO input/input.go:149 input ticker stopped
2020-07-13T21:11:05.928+0500 INFO input/input.go:167 Stopping Input: 17710906643561384400
2020-07-13T21:11:05.928+0500 INFO input/input.go:149 input ticker stopped
2020-07-13T21:11:05.928+0500 INFO input/input.go:167 Stopping Input: 11090588581146109887
2020-07-13T21:11:05.928+0500 INFO input/input.go:149 input ticker stopped
2020-07-13T21:11:05.928+0500 INFO input/input.go:167 Stopping Input: 8766092168909802026
2020-07-13T21:11:05.928+0500 INFO input/input.go:149 input ticker stopped
2020-07-13T21:11:05.928+0500 INFO input/input.go:149 input ticker stopped
2020-07-13T21:11:05.928+0500 INFO log/harvester.go:320 Reader was closed: /root/docker/Run_Upaisa_Mobiliser/logs/money/mobiliser.log.prefs. Closing.
2020-07-13T21:11:05.928+0500 INFO input/input.go:149 input ticker stopped
2020-07-13T21:11:05.928+0500 INFO input/input.go:167 Stopping Input: 6689331407375409998
2020-07-13T21:11:05.928+0500 INFO input/input.go:149 input ticker stopped
2020-07-13T21:11:05.928+0500 INFO input/input.go:167 Stopping Input: 3182145491604238175
2020-07-13T21:11:05.928+0500 INFO log/harvester.go:320 Reader was closed: /root/docker/Run_Upaisa_Mobiliser/logs/money/mobiliser.log.job. Closing.
2020-07-13T21:11:05.928+0500 INFO log/harvester.go:320 Reader was closed: /root/docker/Run_Upaisa_Mobiliser/logs/money/mobiliser.log. Closing.
2020-07-13T21:11:05.928+0500 INFO input/input.go:167 Stopping Input: 6108434255776545120
2020-07-13T21:11:05.928+0500 INFO input/input.go:149 input ticker stopped
2020-07-13T21:11:05.928+0500 INFO input/input.go:167 Stopping Input: 5867589917011989925
2020-07-13T21:11:05.928+0500 INFO input/input.go:149 input ticker stopped
2020-07-13T21:11:05.928+0500 INFO input/input.go:167 Stopping Input: 14849457353757332425
2020-07-13T21:11:05.928+0500 INFO input/input.go:167 Stopping Input: 9166002326357907086
2020-07-13T21:11:05.928+0500 INFO input/input.go:167 Stopping Input: 8981940812540874403
2020-07-13T21:11:05.928+0500 INFO beater/crawler.go:164 Crawler stopped
2020-07-13T21:11:05.928+0500 INFO registrar/registrar.go:367 Stopping Registrar
2020-07-13T21:11:05.928+0500 INFO registrar/registrar.go:293 Ending Registrar
2020-07-13T21:11:05.932+0500 INFO [monitoring] log/log.go:153 Total non-zero metrics {"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":41110,"time":{"ms":41112}},"total":{"ticks":102790,"time":{"ms":102796},"value":102790},"user":{"ticks":61680,"time":{"ms":61684}}},"handles":{"limit":{"hard":65535,"soft":65535},"open":17},"info":{"ephemeral_id":"9ae89486-06fd-4361-a484-8af7d1abfe88","uptime":{"ms":7883644}},"memstats":{"gc_next":25211968,"memory_alloc":12974112,"memory_total":15904755120,"rss":171151360},"runtime":{"goroutines":34}},"filebeat":{"events":{"added":140658,"done":140658},"harvester":{"closed":18,"open_files":0,"running":0,"started":18}},"libbeat":{"config":{"module":{"running":0},"reloads":1,"scans":1},"output":{"events":{"acked":140344,"batches":5362,"total":140344},"read":{"bytes":32172},"type":"logstash","write":{"bytes":100263721}},"pipeline":{"clients":0,"events":{"active":0,"filtered":314,"published":140344,"retry":2048,"total":140658},"queue":{"acked":140344}}},"registrar":{"states":{"cleanup":9,"current":14,"update":140658},"writes":{"success":5409,"total":5409}},"system":{"cpu":{"cores":4},"load":{"1":0.41,"15":0.59,"5":0.48,"norm":{"1":0.1025,"15":0.1475,"5":0.12}}}}}}
2020-07-13T21:11:05.932+0500 INFO [monitoring] log/log.go:154 Uptime: 2h11m23.645620344s
2020-07-13T21:11:05.932+0500 INFO [monitoring] log/log.go:131 Stopping metrics logging.
2020-07-13T21:11:05.932+0500 INFO instance/beat.go:444 filebeat stopped.

That would suggest that Filebeat is being asked to stop by someone/something. You may need to check your OS logs to see if they show anything that might help.

I have observed a pattern which shows that it get stopped after 2h13m43 and 2h11m23. IT runs well for 2 hours and then gets stopped.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.