Filebeat not starting properly after host start

Elastic Stack Beats
1

Hi everyone, I am running filebeat 7.5.0 on centos with systemd and everything works fine except when I restart the host (the filebeat service is enabled).

According to systemd the service is running fine, yet it does nothing.
In the filebeat log I can only see the following:

2020-10-26T15:03:09.092+0100	INFO	instance/beat.go:610	Home path: [/usr/share/filebeat] Config path: [/etc/filebeat] Data path: [/var/lib/filebeat] Logs path: [/var/log/filebeat]
2020-10-26T15:03:09.114+0100	INFO	instance/beat.go:618	Beat ID: 44a5a206-408b-48ed-8629-c2265aa22133

If I restart the service (systemctl restart filebeat) everything is fine and the log has more entries:


2020-10-26T16:03:09.092+0100	INFO	instance/beat.go:610	Home path: [/usr/share/filebeat] Config path: [/etc/filebeat] Data path: [/var/lib/filebeat] Logs path: [/var/log/filebeat]
2020-10-26T16:03:09.114+0100	INFO	instance/beat.go:618	Beat ID: 44a5a206-408b-48ed-8629-c2265aa22133
2020-10-26T16:03:09.214+0100	INFO	seccomp/seccomp.go:124 Syscall filter successfully installed
2020-10-26T16:03:09.214+0100	INFO	[beat] instance/beat.go:841 ...
...
2

Hi!

Can you provide more information about your environment and your setup (what process do you follow to setup fb) so as to try to reproduce it?

3

Thanks for your reply. Not sure what information you need but I will provide some stuff:

OperatingSystem

CentOS Linux release 7.6.1810 (Core)
Kernel: 3.10.0-1127.19.1.el7.x86_64

Filebeat

  • Installed via yum
  • Systemd unit
[Unit]
Description=Filebeat sends log files to Logstash or directly to Elasticsearch.
Documentation=https://www.elastic.co/products/beats/filebeat
Wants=network-online.target
After=network-online.target

[Service]

Environment="BEAT_LOG_OPTS=-e"
Environment="BEAT_CONFIG_OPTS=-c /etc/filebeat/filebeat.yml"
Environment="BEAT_PATH_OPTS=-path.home /usr/share/filebeat -path.config /etc/filebeat -path.data /var/lib/filebeat -path.logs /var/log/filebeat"
ExecStart=/usr/share/filebeat/bin/filebeat $BEAT_LOG_OPTS $BEAT_CONFIG_OPTS $BEAT_PATH_OPTS
Restart=always

[Install]
WantedBy=multi-user.target
4

Thanks for providing the info!

Tested on GCP with Centos 7 following the steps of https://www.elastic.co/guide/en/beats/filebeat/current/setup-repositories.html.

I cannot see a similar behaviour after stoping and restarting the VM.

Here is the service spec:

[user@centos-test ~]$ cat /usr/lib/systemd/system/filebeat.service
[Unit]
Description=Filebeat sends log files to Logstash or directly to Elasticsearch.
Documentation=https://www.elastic.co/products/beats/filebeat
Wants=network-online.target
After=network-online.target
[Service]
Environment="BEAT_LOG_OPTS="
Environment="BEAT_CONFIG_OPTS=-c /etc/filebeat/filebeat.yml"
Environment="BEAT_PATH_OPTS=--path.home /usr/share/filebeat --path.config /etc/filebeat --path.data /var/lib/filebeat --path.logs /var/log/filebeat"
ExecStart=/usr/share/filebeat/bin/filebeat --environment systemd $BEAT_LOG_OPTS $BEAT_CONFIG_OPTS $BEAT_PATH_OPTS
Restart=always
[Install]
WantedBy=multi-user.target
5

Hi there, thanks for your effort!
Unfortunately you couldn't reproduce it - I also noticed that this does only happen every now and then.
No idea what else I could provide / what it could be.

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.