# Filebeat restarting continuously with high memory usage on version 7.9.0 **URL:** \ **Category:** Beats\ **Tags:** filebeat\ **Created:** [October 31, 2023, 12:17pm UTC](https://discuss.elastic.co/t/filebeat-restarting-continuously-with-high-memory-usage-on-version-7-9-0/346132 "2023-10-31T12:17:35Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![kait](https://avatars.discourse-cdn.com/v4/letter/k/96bed5/32.png) [@kait](https://discuss.elastic.co/u/kait)\ **Post date:** [October 31, 2023, 12:17pm UTC](https://discuss.elastic.co/t/filebeat-restarting-continuously-with-high-memory-usage-on-version-7-9-0/346132/1 "2023-10-31T12:17:35Z")
Hi, Filebeat is deployed as daemonset in all kubernetes nodes and it's restarting continuously in specific nodes which is loaded due to high memory usage. Filebeat version : 7.9.0 In filebeat.yml , tried to disable the "default\_matchers.enabled: true" inside add\_kubernetes\_metadata processor (which is enabled by default) by : ```auto processors: - add_kubernetes_metadata: default_matchers.enabled: false ``` After this, the memory usage becomes low and the filebeat not restarted anymore. Could anyone please help in getting the below details: 1. Do disabling this default matchers processor have any impact on log processing and shipment to logstash/elasticsearch or in kibana UI visualization? 2. Why this default matchers processor is causing very high memory usage? 3. Also, in kibana could see the log events are available with metadata info even after disabling default matcher processor. So, what's the actual use of default matcher processor? 4. Is there any other way to decrease the memory usage caused by metadata attached to events rather than disabling default matchers processor ? ---
**Author:** ![kait](https://avatars.discourse-cdn.com/v4/letter/k/96bed5/32.png) [@kait](https://discuss.elastic.co/u/kait)\ **Post date:** [November 1, 2023, 3:21am UTC](https://discuss.elastic.co/t/filebeat-restarting-continuously-with-high-memory-usage-on-version-7-9-0/346132/2 "2023-11-01T03:21:21Z")
Hi Team, Could anyone please help here? ---
**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Post date:** [November 1, 2023, 3:40am UTC](https://discuss.elastic.co/t/filebeat-restarting-continuously-with-high-memory-usage-on-version-7-9-0/346132/3 "2023-11-01T03:40:59Z")
Hello, Filebeat 7.9.0 is pretty old and not supported anymore, you are missing years of updates and bugfixes. You should upgrade to a supported version and see if the issue persists. Since you are using Filebeat 7.X, it will be easier to upgrade to Filebeat 7.17.14, which is the more recent and supported release on branch 7. ---
**Author:** ![kait](https://avatars.discourse-cdn.com/v4/letter/k/96bed5/32.png) [@kait](https://discuss.elastic.co/u/kait)\ **Post date:** [November 1, 2023, 4:03am UTC](https://discuss.elastic.co/t/filebeat-restarting-continuously-with-high-memory-usage-on-version-7-9-0/346132/4 "2023-11-01T04:03:28Z")
Okay sure.. Asking just for my knowledge, In 7.9.0 after disabling "default\_matchers" in add\_kubernetes\_metadata processor will filebeat be able to collect metadata info ? ---
**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Post date:** [November 1, 2023, 12:24pm UTC](https://discuss.elastic.co/t/filebeat-restarting-continuously-with-high-memory-usage-on-version-7-9-0/346132/5 "2023-11-01T12:24:59Z")
> [@kait](#): > > Asking just for my knowledge, In 7.9.0 after disabling "default\_matchers" in add\_kubernetes\_metadata processor will filebeat be able to collect metadata info ? I have no idea, I do not use Kubernetes, but looking from the documentation I would assume that you will not have any metadata. Just check this part of the documentation: > `default_matchers.enabled` > (Optional) Enable or disable default pod matchers when you want to specify your own. If you disable and do not specify your own matchers to get the metadata, I would not expect any metadata. ---
**Author:** ![kait](https://avatars.discourse-cdn.com/v4/letter/k/96bed5/32.png) [@kait](https://discuss.elastic.co/u/kait)\ **Post date:** [November 2, 2023, 5:38am UTC](https://discuss.elastic.co/t/filebeat-restarting-continuously-with-high-memory-usage-on-version-7-9-0/346132/6 "2023-11-02T05:38:30Z")
But even after disabling default\_matchers, I'm able to see metadata info from kibana. Bit confused here. Will the kubernetes provider adds metadata by default in filebeat 7.9.0 without add\_kubernetes\_metadata processor or it won't. Could anyone please confirm this ? ---
**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Post date:** [November 2, 2023, 12:31pm UTC](https://discuss.elastic.co/t/filebeat-restarting-continuously-with-high-memory-usage-on-version-7-9-0/346132/7 "2023-11-02T12:31:48Z")
Did you disable the `default_indexers` as well? According to the [documentation](https://www.elastic.co/guide/en/beats/filebeat/7.9/add-kubernetes-metadata.html#add-kubernetes-metadata), this processors has two building blocks, indexers and matchers, so I'm assuming you need to disable both as mentioned in the documentation. > This behaviour can be disabled by disabling default indexers and matchers in the configuration: ```auto processors: - add_kubernetes_metadata: default_indexers.enabled: false default_matchers.enabled: false ``` See if changing this solves your issue, if not, please upgrade to a supported version and check if the issue is still happening. It may be a bug, this version is 3 years old. ---
**Author:** ![kait](https://avatars.discourse-cdn.com/v4/letter/k/96bed5/32.png) [@kait](https://discuss.elastic.co/u/kait)\ **Post date:** [November 2, 2023, 1:29pm UTC](https://discuss.elastic.co/t/filebeat-restarting-continuously-with-high-memory-usage-on-version-7-9-0/346132/8 "2023-11-02T13:29:03Z")
Have only disabled the default\_matchers, and the high memory issue is resolved. Not provided any custom matchers also, but getting metadata from kibana. Need to understand how the metadata is being added to events. Also, disabling this default matcher have any internal impact on log processing. ---
**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Post date:** [November 2, 2023, 1:32pm UTC](https://discuss.elastic.co/t/filebeat-restarting-continuously-with-high-memory-usage-on-version-7-9-0/346132/9 "2023-11-02T13:32:45Z")
Please, check the linked documentation, the `add_kubernetes_metadata` has two building blocks, indexers and matchers, you disabled just one. The documentation explain what they are and what kind of metadata each one of them can get. ---
**Author:** ![Saju\_M](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/saju_m/32/127832_2.png) [@Saju\_M](https://discuss.elastic.co/u/Saju_M)\ **Post date:** [November 21, 2023, 9:07am UTC](https://discuss.elastic.co/t/filebeat-restarting-continuously-with-high-memory-usage-on-version-7-9-0/346132/10 "2023-11-21T09:07:43Z")
You dont need to enable it again if you are using filebeat.autodiscover > [@Is add\_kubernetes\_metadata in filebeat enabled by default?](https://discuss.elastic.co/t/is-add-kubernetes-metadata-in-filebeat-enabled-by-default/232064): > > Just a general question I guess since the documentation wasn't very clear to me. When running Filebeat on Kubernetes as instructed here, [https://www.elastic.co/guide/en/beats/filebeat/master/running-on-kubernetes.html](https://www.elastic.co/guide/en/beats/filebeat/master/running-on-kubernetes.html) Is the add\_kubernetes\_metadata processor supposed to be enabled by default? Or do I need to configure to enable? I'm using v7.6. Please check it and let me know @kait ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [December 19, 2023, 11:08am UTC](https://discuss.elastic.co/t/filebeat-restarting-continuously-with-high-memory-usage-on-version-7-9-0/346132/11 "2023-12-19T11:08:25Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.