Filebeat not starting properly after host start

Hi everyone, I am running filebeat 7.5.0 on centos with systemd and everything works fine except when I restart the host (the filebeat service is enabled).

According to systemd the service is running fine, yet it does nothing.
In the filebeat log I can only see the following:

2020-10-26T15:03:09.092+0100	INFO	instance/beat.go:610	Home path: [/usr/share/filebeat] Config path: [/etc/filebeat] Data path: [/var/lib/filebeat] Logs path: [/var/log/filebeat]
2020-10-26T15:03:09.114+0100	INFO	instance/beat.go:618	Beat ID: 44a5a206-408b-48ed-8629-c2265aa22133

If I restart the service (systemctl restart filebeat) everything is fine and the log has more entries:


2020-10-26T16:03:09.092+0100	INFO	instance/beat.go:610	Home path: [/usr/share/filebeat] Config path: [/etc/filebeat] Data path: [/var/lib/filebeat] Logs path: [/var/log/filebeat]
2020-10-26T16:03:09.114+0100	INFO	instance/beat.go:618	Beat ID: 44a5a206-408b-48ed-8629-c2265aa22133
2020-10-26T16:03:09.214+0100	INFO	seccomp/seccomp.go:124 Syscall filter successfully installed
2020-10-26T16:03:09.214+0100	INFO	[beat] instance/beat.go:841 ...
...

Hi!

Can you provide more information about your environment and your setup (what process do you follow to setup fb) so as to try to reproduce it?

Thanks for your reply. Not sure what information you need but I will provide some stuff:

OperatingSystem

CentOS Linux release 7.6.1810 (Core)
Kernel: 3.10.0-1127.19.1.el7.x86_64

Filebeat

  • Installed via yum
  • Systemd unit
[Unit]
Description=Filebeat sends log files to Logstash or directly to Elasticsearch.
Documentation=https://www.elastic.co/products/beats/filebeat
Wants=network-online.target
After=network-online.target

[Service]

Environment="BEAT_LOG_OPTS=-e"
Environment="BEAT_CONFIG_OPTS=-c /etc/filebeat/filebeat.yml"
Environment="BEAT_PATH_OPTS=-path.home /usr/share/filebeat -path.config /etc/filebeat -path.data /var/lib/filebeat -path.logs /var/log/filebeat"
ExecStart=/usr/share/filebeat/bin/filebeat $BEAT_LOG_OPTS $BEAT_CONFIG_OPTS $BEAT_PATH_OPTS
Restart=always

[Install]
WantedBy=multi-user.target

Thanks for providing the info!

Tested on GCP with Centos 7 following the steps of https://www.elastic.co/guide/en/beats/filebeat/current/setup-repositories.html.

I cannot see a similar behaviour after stoping and restarting the VM.

Here is the service spec:

[user@centos-test ~]$ cat /usr/lib/systemd/system/filebeat.service
[Unit]
Description=Filebeat sends log files to Logstash or directly to Elasticsearch.
Documentation=https://www.elastic.co/products/beats/filebeat
Wants=network-online.target
After=network-online.target
[Service]
Environment="BEAT_LOG_OPTS="
Environment="BEAT_CONFIG_OPTS=-c /etc/filebeat/filebeat.yml"
Environment="BEAT_PATH_OPTS=--path.home /usr/share/filebeat --path.config /etc/filebeat --path.data /var/lib/filebeat --path.logs /var/log/filebeat"
ExecStart=/usr/share/filebeat/bin/filebeat --environment systemd $BEAT_LOG_OPTS $BEAT_CONFIG_OPTS $BEAT_PATH_OPTS
Restart=always
[Install]
WantedBy=multi-user.target

Hi there, thanks for your effort!
Unfortunately you couldn't reproduce it - I also noticed that this does only happen every now and then.
No idea what else I could provide / what it could be.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.