We are using filebeat on aws windows machines to push their log to local logstash and then local ES.
Recently, some error occurs when I enter the command to test the output status on those AWS machines.
The command is filebeat.exe test output and the output is like
$ ./filebeat.exe test output
2021-03-08 23:09:58.1009325 +0800 CST m=+0.152997401 write error: failed to rotate backups: failed to rotate backups:
rename C:\Program Files\Filebeat\logs\filebeat C:\Program Files\Filebeat\logs\filebeat-2021-03-08-23-1: The process
cannot access the file because it is being used by another process.
2021-03-08 23:09:58.1019319 +0800 CST m=+0.153996801 write error: failed to rotate backups: failed to rotate backups:
rename C:\Program Files\Filebeat\logs\filebeat C:\Program Files\Filebeat\logs\filebeat-2021-03-08-23-1: The process
cannot access the file because it is being used by another process.
logstash: elasticsearchnode:xxxx...
connection...
parse host... OK
dns lookup... OK
addresses: xxx.xxx.xxx.xxx
dial up... OK
TLS...
security: server's certificate chain verification is enabled
handshake... ERROR read tcp xxx.xxx.xxxx.xxx:xxxxx->xxx.xxx.xxx.xxx:xxxx: i/o timeout
I am not sure why it show the log file is used by other process because there is only one filebeat instance on the machine. And although the i/o is timeout, the log is being pushed actually. If I run the command on local machine with filebeat, there is no error.
Is there any one who could shed some light on it?