Filebeat servce cannot start on my OS

Elastic Stack Elasticsearch
1

My filebeat service cannot start and is showing follow log in follow path:

/var/log/filebeat/filebeat.log-20241017.ndjson

{"log.level":"error","@timestamp":"2024-10-17T10:58:05.253+0330","log.logger":"input","log.origin":{"file.name":"log/input.go","file.line":591},"message":"Harvester could not be started on truncated file: /home/tomcat_normalizeradmin/logs/catalina.out, Err: registry already stopped","service.name":"filebeat","input_id":"6472b3ae-373f-454a-88a0-5d734dcf616e","source_file":"/home/tomcat_normalizeradmin/logs/catalina.out","state_id":"native::2100646-64770","finished":false,"os_id":"2100646-64770","old_source":"/home/tomcat_normalizeradmin/logs/catalina.out","old_finished":true,"old_os_id":"2100646-64770","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2024-10-17T10:58:05.253+0330","log.origin":{"file.name":"input/input.go","file.line":134},"message":"input ticker stopped","service.name":"filebeat","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2024-10-17T10:58:05.253+0330","log.origin":{"file.name":"input/input.go","file.line":134},"message":"input ticker stopped","service.name":"filebeat","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2024-10-17T10:58:05.253+0330","log.origin":{"file.name":"input/input.go","file.line":134},"message":"input ticker stopped","service.name":"filebeat","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2024-10-17T10:58:05.253+0330","log.origin":{"file.name":"input/input.go","file.line":134},"message":"input ticker stopped","service.name":"filebeat","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2024-10-17T10:58:05.253+0330","log.origin":{"file.name":"harvester/forwarder.go","file.line":52},"message":"Input outlet closed","service.name":"filebeat","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2024-10-17T10:58:05.253+0330","log.origin":{"file.name":"beater/crawler.go","file.line":185},"message":"Crawler stopped","service.name":"filebeat","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2024-10-17T10:58:05.253+0330","log.logger":"registrar","log.origin":{"file.name":"registrar/registrar.go","file.line":132},"message":"Stopping Registrar","service.name":"filebeat","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2024-10-17T10:58:05.253+0330","log.logger":"registrar","log.origin":{"file.name":"registrar/registrar.go","file.line":166},"message":"Ending Registrar","service.name":"filebeat","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2024-10-17T10:58:05.254+0330","log.logger":"registrar","log.origin":{"file.name":"registrar/registrar.go","file.line":137},"message":"Registrar stopped","service.name":"filebeat","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2024-10-17T10:58:05.272+0330","log.logger":"monitoring","log.origin":{"file.name":"log/log.go","file.line":195},"message":"Total metrics","service.name":"filebeat","monitoring":{"metrics":{"beat":{"cpu":{"system":{"ticks":100,"time":{"ms":100}},"total":{"ticks":980,"time":{"ms":980},"value":980},"user":{"ticks":880,"time":{"ms":880}}},"handles":{"limit":{"hard":4096,"soft":4096},"open":9},"info":{"ephemeral_id":"1bdf06b8-e0df-4a85-9acc-10c622b706a6","name":"filebeat","uptime":{"ms":724},"version":"8.7.0"},"memstats":{"gc_next":18131712,"memory_alloc":13524520,"memory_sys":40416520,"memory_total":152339472,"rss":86122496},"runtime":{"goroutines":11}},"filebeat":{"events":{"active":112,"added":112,"done":0},"harvester":{"closed":4,"open_files":1,"running":0,"skipped":0,"started":4},"input":{"log":{"files":{"renamed":0,"truncated":2}},"netflow":{"flows":0,"packets":{"dropped":0,"received":0}}}},"libbeat":{"config":{"module":{"running":0,"starts":0,"stops":0},"reloads":0,"scans":0},"output":{"events":{"acked":0,"active":0,"batches":0,"dropped":0,"duplicates":0,"failed":0,"toomany":0,"total":0},"read":{"bytes":0,"errors":0},"type":"elasticsearch","write":{"bytes":0,"errors":0}},"pipeline":{"clients":0,"events":{"active":97,"dropped":0,"failed":0,"filtered":15,"published":97,"retry":0,"total":112},"queue":{"acked":0,"max_events":4096}}},"registrar":{"states":{"cleanup":2,"current":0,"update":9},"writes":{"fail":0,"success":0,"total":0}},"system":{"cpu":{"cores":16},"load":{"1":0.12,"15":0.09,"5":0.09,"norm":{"1":0.0075,"15":0.0056,"5":0.0056}}}},"ecs.version":"1.6.0"}}
{"log.level":"info","@timestamp":"2024-10-17T10:58:05.272+0330","log.logger":"monitoring","log.origin":{"file.name":"log/log.go","file.line":196},"message":"Uptime: 728.017443ms","service.name":"filebeat","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2024-10-17T10:58:05.272+0330","log.logger":"monitoring","log.origin":{"file.name":"log/log.go","file.line":163},"message":"Stopping metrics logging.","service.name":"filebeat","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2024-10-17T10:58:05.272+0330","log.origin":{"file.name":"instance/beat.go","file.line":491},"message":"filebeat stopped.","service.name":"filebeat","ecs.version":"1.6.0"}
{"log.level":"error","@timestamp":"2024-10-17T10:58:05.274+0330","log.origin":{"file.name":"instance/beat.go","file.line":1071},"message":"Exiting: Failed to start crawler: starting input failed: input with same ID already exists: 16301159156152094700","service.name":"filebeat","ecs.version":"1.6.0"}

Would you please help me about it ?

2

Would you please help me ?

3

You need to share your filebeat.yml, without it is not possible to know what may be the issue.

Your log says that you have two inputs with the same ID, this is not allowed.