FileBeat is not noticing new entries in our log files. To take one example we have a logfile modified recently (20:59 CET) but the registry is showing 14:40 UTC (15:40 CET): {"source":"D:\hybris\log\tomcat\access.20190227.log","offset":68114397,"timestamp":"2019-02-27T14:40:32.1251557+01:00" We ha…

Could you please share the debug logs of your Filebeat instance? Also, please paste its configuration file here formatted using </>. My hunch is that either Logstash or Elasticsearch is not able to process the requests quickly enough, so Filebeat stops reading new events until it can forward events…

Discuss the Elastic Stack

FileBeat not following logfile

Elastic Stack Beats

cawoodm (Marc) March 1, 2019, 3:40pm 3

Yes, that was indeed the case. Elastic Search was waaay behind it's workload.

Topic		Replies	Views
Filebeat not reading new logs changes when manually updated one of the logs Beats filebeat	17	7980	July 5, 2017
Filebeat is not reading updated logfile Beats filebeat	6	2030	July 11, 2016
Filebeat registry file and log.json are not updated Beats filebeat	1	263	January 15, 2024
Filebeat is not sending new events to logstash Beats filebeat	1	298	November 30, 2021
Filebeat stops harvesting - file didn't change Beats filebeat	6	3814	July 5, 2017

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.

FileBeat not following logfile

Related topics