# Filebeat on director role node spams **URL:** \ **Category:** Elastic Cloud Enterprise (ECE)\ **Created:** [May 1, 2017, 8:19pm UTC](https://discuss.elastic.co/t/filebeat-on-director-role-node-spams/84181 "2017-05-01T20:19:41Z")\ **Posts on this page:** 12\ **Page:** 1
**Author:** ![iremmats](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/iremmats/32/55316_2.png) [@iremmats](https://discuss.elastic.co/u/iremmats)\ **Post date:** [May 1, 2017, 8:19pm UTC](https://discuss.elastic.co/t/filebeat-on-director-role-node-spams/84181/1 "2017-05-01T20:19:41Z")
Noticed that Filebeat on one of our servers in ECE goes bananas. Where as other vms with same config, same settings and same roles sends about 1000 logs per 15 minutes this server sends roughly 500k in same time period. It also seems alot of those logs are old ones. ![](https://us1.discourse-cdn.com/elastic/original/3X/9/c/9c29deb0193d93ede9cb968c31b8a1b271d493f1.png) ---
**Author:** ![nrichers](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nrichers/32/17801_2.png) [@nrichers](https://discuss.elastic.co/u/nrichers)\ **Post date:** [May 1, 2017, 10:26pm UTC](https://discuss.elastic.co/t/filebeat-on-director-role-node-spams/84181/2 "2017-05-01T22:26:53Z")
@iremmats Is that server on the beta1 or the beta2 release of ECE? I believe one of the improvements in beta2 is that Filebeat is more selective about what gets sent. I relayed your question to the developer who worked on this part of ECE. Nik ---
**Author:** ![joegallo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/joegallo/32/14287_2.png) [@joegallo](https://discuss.elastic.co/u/joegallo)\ **Post date:** [May 1, 2017, 11:37pm UTC](https://discuss.elastic.co/t/filebeat-on-director-role-node-spams/84181/3 "2017-05-01T23:37:14Z")
Hello, @iremmats! Echoing @nrichers question, and adding a few more of my own: 1. Is that server on the beta1 or the beta2 release of ECE? 2. On the affected host, are all log files affected, or only some? For example, are you seeing high traffic from only file X, or high traffic from files X, Y, and Z? I'm most interested here in getting a list of the affected files for the high traffic situation. 3. Same as the previous question, but regarding the "a lot of those logs are old ones" instead -- exactly which files are affected by the duplicate sending behavior? I'll probably have more questions once you get me the answers to these, but this will help us get started. ---
**Author:** ![iremmats](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/iremmats/32/55316_2.png) [@iremmats](https://discuss.elastic.co/u/iremmats)\ **Post date:** [May 2, 2017, 6:40am UTC](https://discuss.elastic.co/t/filebeat-on-director-role-node-spams/84181/4 "2017-05-02T06:40:34Z")
1. The server is Beta2. We ran Beta1 before (on other machines, other network etc) and the difference in how much metrics are gathered from the machines themselves is big. Good work there. 🙂 2 and 3. Im attaching some screenshots. They are from one about one hour worth of time. In the last one you can see there is a different time the event is added to Elasticsearch from the actual timestamp of the row. ![](https://us1.discourse-cdn.com/elastic/original/3X/c/8/c8bf5a054ea562c74a1fb7e7d1377af693513172.png) ![](https://us1.discourse-cdn.com/elastic/original/3X/d/c/dc8bc63302c9d1cb34ab78eaa90cc8ad2d43b647.png) ![](https://us1.discourse-cdn.com/elastic/original/3X/e/4/e46b27e147c3764b8af4718541466a915cce2fce.png) ---
**Author:** ![joegallo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/joegallo/32/14287_2.png) [@joegallo](https://discuss.elastic.co/u/joegallo)\ **Post date:** [May 2, 2017, 1:18pm UTC](https://discuss.elastic.co/t/filebeat-on-director-role-node-spams/84181/5 "2017-05-02T13:18:56Z")
Very interesting -- that information helps a lot. Thanks for sending it. Can you zip up the filebeat logs and send me a link to them? They're accessible at a path like /mnt/data/elastic/YOUR\_RUNNER\_NAME\_HERE/services/beats-runner/logs/filebeat.log\* on the host VM, you don't need to get them out of the beats-runner docker container itself. ---
**Author:** ![joegallo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/joegallo/32/14287_2.png) [@joegallo](https://discuss.elastic.co/u/joegallo)\ **Post date:** [May 2, 2017, 2:46pm UTC](https://discuss.elastic.co/t/filebeat-on-director-role-node-spams/84181/6 "2017-05-02T14:46:40Z")
Along the same lines, if you could send a few of the beats-runner.log files, as well, that would be very helpful. ---
**Author:** ![iremmats](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/iremmats/32/55316_2.png) [@iremmats](https://discuss.elastic.co/u/iremmats)\ **Post date:** [May 2, 2017, 5:03pm UTC](https://discuss.elastic.co/t/filebeat-on-director-role-node-spams/84181/7 "2017-05-02T17:03:20Z")
Here are all the stuff from that folder. Next time give me a logstash configuration and an Elasticsearch endpoint. Sending text files is so 2005. 😉 > **[Dropbox - Link not found](https://www.dropbox.com/s/qnnvbfgstrijwyt/beats.tgz?dl=0)** > > Dropbox is a free service that lets you bring your photos, docs, and videos anywhere and share them easily. Never email yourself a file again! > **[Dropbox - Link not found](https://www.dropbox.com/s/nboqm0y5a2qjasy/filebeat.tgz?dl=0)** > > Dropbox is a free service that lets you bring your photos, docs, and videos anywhere and share them easily. Never email yourself a file again! > **[Dropbox - Link not found](https://www.dropbox.com/s/8jhsanv7fu3galr/metricbeat.tgz?dl=0)** > > Dropbox is a free service that lets you bring your photos, docs, and videos anywhere and share them easily. Never email yourself a file again! ---
**Author:** ![iremmats](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/iremmats/32/55316_2.png) [@iremmats](https://discuss.elastic.co/u/iremmats)\ **Post date:** [May 2, 2017, 5:55pm UTC](https://discuss.elastic.co/t/filebeat-on-director-role-node-spams/84181/8 "2017-05-02T17:55:38Z")
![](https://us1.discourse-cdn.com/elastic/original/3X/5/9/59cebd3050314b14effefcf545cc14a0f06519b0.png) And a screenshot of the folder so you also get the modified timestamp on each one. ---
**Author:** ![joegallo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/joegallo/32/14287_2.png) [@joegallo](https://discuss.elastic.co/u/joegallo)\ **Post date:** [May 2, 2017, 6:00pm UTC](https://discuss.elastic.co/t/filebeat-on-director-role-node-spams/84181/9 "2017-05-02T18:00:17Z")
Alright, I've got a potential fix for you, I'd like you to try killing the beats-runner container, it'll restart automatically, and I think when it comes back up the problem will have gone away (if it doesn't, then that will also be highly valuable information): ``` docker kill frc-beats-runners-beats-runner ``` Can you run the above command on the affected host and let me know if that solves the problem? ---
**Author:** ![iremmats](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/iremmats/32/55316_2.png) [@iremmats](https://discuss.elastic.co/u/iremmats)\ **Post date:** [May 2, 2017, 8:23pm UTC](https://discuss.elastic.co/t/filebeat-on-director-role-node-spams/84181/10 "2017-05-02T20:23:19Z")
I demoted the server from ECE yesterday (and attached another one) so that command doesn't do anything. ☹ If if happens again Ill try restarting the docker containers though. ---
**Author:** ![joegallo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/joegallo/32/14287_2.png) [@joegallo](https://discuss.elastic.co/u/joegallo)\ **Post date:** [May 2, 2017, 9:14pm UTC](https://discuss.elastic.co/t/filebeat-on-director-role-node-spams/84181/11 "2017-05-02T21:14:02Z")
@iremmats Alright, sounds good. Please do reach out if the problem comes up again. And thanks very much for sending us those logs, they were very helpful for us. Cheers! ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [May 16, 2017, 9:27pm UTC](https://discuss.elastic.co/t/filebeat-on-director-role-node-spams/84181/12 "2017-05-16T21:27:17Z")
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.