Filebeat reading file even after not mentioning it in filebeat.yml


(Nitin Bhaisare) #1

Hello,

I have a file which is not mentioned in the filebeat.yml but i can still see that opened by filebeat in lsof -c filebeat output.
anyone any idea about what is happening here??

Thanks,
Nitin


(Carlos Pérez Aradros) #2

Could you please give more details? I would like to see the path for the file and filebeat settings


(Nitin Bhaisare) #3
filebeat.prospectors:


- input_type: log

  paths:
    - /var/log/secure
    - /var/log/messages
  document_type: sys-syslog

- input_type: log
  paths:
    - /var/log/cron
  document_type: sys-cron

- input_type: log
  paths:
    - /var/log/yum.log
  document_type: sys-yum
output.logstash:
  enabled: true
  hosts: ["10.204.140.17:5044","10.204.141.17:5044","10.204.140.18:5044","10.204.141.18:5044"]
  worker: 1
  loadbalance: true

logging.to_files: true
logging.files:

(Nitin Bhaisare) #4

I am pushing filebeat prospectors via ansible but they are not reflected in filebeat.yml . Even though in lsof output i can see the file is opened by filebeat


(Carlos Pérez Aradros) #5

What's the open file?


(Nitin Bhaisare) #6

sorry i didn't get that.. I am using this command "lsof -c filebeat " to see if file is read by filebeat.


(Carlos Pérez Aradros) #7

Got it, perhaps you can share the output of lsof?


(Nitin Bhaisare) #8

nohup.out is the file


(Tudor Golubenco) #9

I suspect that what happens here is that ansible or something else runs the init script command via nohup (the nohup.out is specific for that command). The file descriptor gets passed through a couple of forks and execs and eventually is inherited by filebeat itself.

What ansible module do you use for starting filebeat? Generally nohup shouldn't be needed.


(Tudor Golubenco) #10

In any case, it's not that Filebeat is reading that file, just that it has a reference to it.


(system) #11

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.