Hi,
Issue 1) i have configured file beat (filebeat-5.0.0-rc1-linux-x86_64) with elasticsearch (without logstash). Its observed after few scan cycles it is not able to ship the data from log files to elasticsearch engine.
here is the command executed to run filebeat as bacjground process
./filebeat -c filebeat.full.yml -e"*"&
Issue 2) Is there any way to safely shutdown filebeat without killing process?
Issue 3) also, on restart of filebeat, it is reading contents from scrach instaed of reading from last line which was added in log file. timebeing i have set tail_files: true not sure is this going to solve the problem.
Please help. Note i have raised 3 question, pl respond by each issue wise.
I think something goes wrong with persisting the state to disk or sending your data. If data is not sent, state is also not persisted. I assume solving problem 1 will solve 3 automatically. No need for tail_files
Log file is less than 1 MB
2-3) Is there any way that filebeat will run forever and will not shutdown?
even if i specify shutdown_timeout as 24 hours what will happen? is it recommonded?
how we can recognise filebeat is running or has stopped? if we we filebeat as background process PID is still showing as active.
what is standard way to watch and restart filebeat?
where i can find out GA release? filebeat-5.0.0-linux-x86_64 is it GA release?
Thanks
Chaitra
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.