I am running into a strange issue with filebeat on one of our production transaction servers.
Background:
Filebeat on one of our production servers went down for some ‘unknown’ reason (still haven’t figured out why this happened) but when I brought the service back up it started without reporting any errors but it isn’t recognizing any file activity. Double checked everything and traffic was coming in but filebeat wasn’t sending any information on to elasticsearch.
I performed a complete uninstall of v7.9.2 (including the service) and then installed 7.10.2 with no change in behavior.
I’ve attached the documents from the server in the attached zip file with the following directory structure
Filebeat Issue
- Config
- Osp.yml
- Logs
- Filebeat.log
- Filebeat_Debug.zip (debugging turned on)
- Filebeat.yml
- Install-service-filebeat.txt (Install-service-filebeat.ps1)
When I place filebeat in debug mode I'm seeing transactions being grabbed by filebeat but not being passed on to elasticsearch. This can seen in the stand-alone log file.
The service is using an account that infrastructure uses to allow servers to talk to each other in production.
This was working up until recently and the infrastructure team swears that there were not changes made to the production server.
Thanks for any help you can provide,
Bill