We have filebeats running on Windows Server 2012 R2 and every time the filebeat service is restart all lines from all harvested logs gets send again.
The registry file is updated (Can be seen from the modification time of the file).
We have furthermore tried to close filebeat, delete the registry file, start filebeat which results in a new registry file being created which seems to be valid.
However, when the service is restarted after the new registry file is created all log lines gets send once more.
All the config options and the registry file seem to be as expected. Can you share some log output from filebeat, best in debug level? Especially the first 200 lines when starting filebeat again with an existing registry file would be interesting. As the lines will not fit in the forum, best post them into a gist and link it here.
Turning on the debug log quickly produced many 1MB log files which contains mostly publish events - this confirms my suspicion that everything gets send again.
I have taken the first ~100 lines and posted here: https://gist.github.com/Steiniche/029069e134aa232f8cee30142b98f4ef
However, I have only included the first Publish event.
Thanks for the logs. It seems that filebeat first finds the states in the registry: States Loaded from registrar: 21 but then fails to match the files to the prospectors and prospectors are started without states. I remember we had an issue about path matching in the 5.0-beta versions but this should have been fixed. I'm curious if this is a similar issue again that it does not match C:/logs/a/server.log and C:\/logs\/a\/server.log from the registry file.
From which version of filebeat were you migrating?
That is really strange Could you share again the log file and registry from 5.2.1 (same as above) so I can have a look again, now without the migration.
I really need to do some testing for this on a Windows machine and try to reproduce it. I'm probably only going to be able to do this next week.
The part that bugs me: In case it is a "general" bug it would affect a lot of user and I would hope it would have popped up much earlier. At the same time, users don't restart filebeat often. Will definitively dig deeper into this one.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.