# Filebeat service hangs on first start amazon ec2

**URL:** https://discuss.elastic.co/t/filebeat-service-hangs-on-first-start-amazon-ec2/46436
**Category:** Beats
**Tags:** filebeat
**Created:** [April 5, 2016, 5:02pm UTC](https://discuss.elastic.co/t/filebeat-service-hangs-on-first-start-amazon-ec2/46436 "2016-04-05T17:02:01Z")
**Posts on this page:** 20
**Page:** 1

<div class="post-metadata">

### Author: ![bmiramont](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bmiramont/32/8906_2.png) [@bmiramont](https://discuss.elastic.co/u/bmiramont)
#### Post date: [April 5, 2016, 5:02pm UTC](https://discuss.elastic.co/t/filebeat-service-hangs-on-first-start-amazon-ec2/46436/1 "2016-04-05T17:02:01Z")

</div>

Hi,

I have a java app on elastic beanstalk.  
I have a ./ebextensions/filebeat.config deployed to my ec2 instances upon EB deployement.

Problem is : the first time the filebeat process is started, it hangs. I have to execute sudo /etc/init.d/filebeat restart to have the deployement resumes.  
the command I use for starting the process is : /etc/init.d/filebeat start

This happens when the command is in the command block, or in a delayed job in the .config file.  
here is the point where it hangs :  
[2016-04-05T17:28:06.251Z] INFO [16221] - [Application update/AppDeployStage1/AppDeployPostHook/03monitor\_pids.sh] : Starting activity...  
[2016-04-05T17:28:06.755Z] INFO [16221] - [Application update/AppDeployStage1/AppDeployPostHook/03monitor\_pids.sh] : Completed activity.  
[2016-04-05T17:28:06.755Z] INFO [16221] - [Application update/AppDeployStage1/AppDeployPostHook/99\_restart\_delayed\_job.sh] : Starting activity...

my script:  
file:  
"/opt/elasticbeanstalk/hooks/appdeploy/post/99\_restart\_delayed\_job.sh":  
mode: "000755"  
owner: root  
group: root  
content: |  
#!/usr/bin/env bash  
/etc/init.d/filebeat start

After that, all the following deployements works normally.

thank you.

---

<div class="post-metadata">

### Author: ![bmiramont](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bmiramont/32/8906_2.png) [@bmiramont](https://discuss.elastic.co/u/bmiramont)
#### Post date: [April 13, 2016, 3:22pm UTC](https://discuss.elastic.co/t/filebeat-service-hangs-on-first-start-amazon-ec2/46436/2 "2016-04-13T15:22:10Z")

</div>

same behavior with topbeat...

---

<div class="post-metadata">

### Author: ![tudor](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tudor/32/3753_2.png) [@tudor](https://discuss.elastic.co/u/tudor)
#### Post date: [April 13, 2016, 8:24pm UTC](https://discuss.elastic.co/t/filebeat-service-hangs-on-first-start-amazon-ec2/46436/3 "2016-04-13T20:24:44Z")

</div>

What operating system are you using? Does it have systemd?

---

<div class="post-metadata">

### Author: ![bmiramont](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bmiramont/32/8906_2.png) [@bmiramont](https://discuss.elastic.co/u/bmiramont)
#### Post date: [April 14, 2016, 7:08am UTC](https://discuss.elastic.co/t/filebeat-service-hangs-on-first-start-amazon-ec2/46436/4 "2016-04-14T07:08:42Z")

</div>

it's an Amazon AMI :  
64bit Amazon Linux 2015.09 v2.0.7 running Tomcat 8 Java 8

I don't think there is systemd

---

<div class="post-metadata">

### Author: ![tudor](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tudor/32/3753_2.png) [@tudor](https://discuss.elastic.co/u/tudor)
#### Post date: [April 14, 2016, 8:21am UTC](https://discuss.elastic.co/t/filebeat-service-hangs-on-first-start-amazon-ec2/46436/5 "2016-04-14T08:21:50Z")

</div>

I see, we did get some other reports regarding this. Most likely the problem is caused by [go-daemon](https://github.com/fiorix/go-daemon), the supervisor that we use. We only use it to put the process in background, so you could replace it fairly easily with the `daemon` tool by editing the init script.

I think I have a grasp now on why go-daemon doesn't do daemonization correctly. If I send you custom `filebeat-god` binary, would you be willing to give it a try to see if it fixes the issue?

---

<div class="post-metadata">

### Author: ![bmiramont](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bmiramont/32/8906_2.png) [@bmiramont](https://discuss.elastic.co/u/bmiramont)
#### Post date: [April 14, 2016, 8:23am UTC](https://discuss.elastic.co/t/filebeat-service-hangs-on-first-start-amazon-ec2/46436/6 "2016-04-14T08:23:24Z")

</div>

sure, I'll give it a try

---

<div class="post-metadata">

### Author: ![tudor](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tudor/32/3753_2.png) [@tudor](https://discuss.elastic.co/u/tudor)
#### Post date: [April 14, 2016, 8:25am UTC](https://discuss.elastic.co/t/filebeat-service-hangs-on-first-start-amazon-ec2/46436/7 "2016-04-14T08:25:55Z")

</div>

Thanks, are you on 32 bits or 64 bits? Or do you have gcc installed on a machine? It might be easier if you compile it yourself, I'll just give you the right commands.

---

<div class="post-metadata">

### Author: ![bmiramont](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bmiramont/32/8906_2.png) [@bmiramont](https://discuss.elastic.co/u/bmiramont)
#### Post date: [April 14, 2016, 8:27am UTC](https://discuss.elastic.co/t/filebeat-service-hangs-on-first-start-amazon-ec2/46436/8 "2016-04-14T08:27:17Z")

</div>

it's 64 bits but I doubt there is gcc on it : 64bit Amazon Linux 2015.09

no gcc but that can be installed via yum

---

<div class="post-metadata">

### Author: ![tudor](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tudor/32/3753_2.png) [@tudor](https://discuss.elastic.co/u/tudor)
#### Post date: [April 14, 2016, 8:33am UTC](https://discuss.elastic.co/t/filebeat-service-hangs-on-first-start-amazon-ec2/46436/9 "2016-04-14T08:33:00Z")

</div>

No need then, I'll give you a binary. Let me just find a place to upload it.

---

<div class="post-metadata">

### Author: ![bmiramont](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bmiramont/32/8906_2.png) [@bmiramont](https://discuss.elastic.co/u/bmiramont)
#### Post date: [April 14, 2016, 8:35am UTC](https://discuss.elastic.co/t/filebeat-service-hangs-on-first-start-amazon-ec2/46436/10 "2016-04-14T08:35:18Z")

</div>

ok great, and please tell me where to put the file then

---

<div class="post-metadata">

### Author: ![tudor](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tudor/32/3753_2.png) [@tudor](https://discuss.elastic.co/u/tudor)
#### Post date: [April 14, 2016, 8:38am UTC](https://discuss.elastic.co/t/filebeat-service-hangs-on-first-start-amazon-ec2/46436/11 "2016-04-14T08:38:58Z")

</div>

Ok, here is the file: [https://beats-nightlies.s3.amazonaws.com/god-linux-64](https://beats-nightlies.s3.amazonaws.com/god-linux-64)

It's a binary build for Linux 64 bit, so you should be able to execute it with `-h` just to make sure that the download worked fine and the file is executable.

If you test with Filebeat you need to copy it over `/usr/bin/filebeat-god` (just replace that file, make a backup if you want). If you test with Topbeat, you need to replace `/usr/bin/topbeat-god`.

Let me know if this seems to solve the issue.

---

<div class="post-metadata">

### Author: ![bmiramont](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bmiramont/32/8906_2.png) [@bmiramont](https://discuss.elastic.co/u/bmiramont)
#### Post date: [April 14, 2016, 8:39am UTC](https://discuss.elastic.co/t/filebeat-service-hangs-on-first-start-amazon-ec2/46436/12 "2016-04-14T08:39:50Z")

</div>

ok, i'll give it a try

---

<div class="post-metadata">

### Author: ![bmiramont](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bmiramont/32/8906_2.png) [@bmiramont](https://discuss.elastic.co/u/bmiramont)
#### Post date: [April 14, 2016, 9:10am UTC](https://discuss.elastic.co/t/filebeat-service-hangs-on-first-start-amazon-ec2/46436/13 "2016-04-14T09:10:28Z")

</div>

hi, I'm trying to replace the file but it is a bit tricky with AWS elastic beanstalk deployement options.

I'll tell when you when it's ok but can you provide me with an rpm with the new god file ? that way I can deploy the whole package on a new platform and thus I'll be able to validate that it's working.

thank you

---

<div class="post-metadata">

### Author: ![tudor](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tudor/32/3753_2.png) [@tudor](https://discuss.elastic.co/u/tudor)
#### Post date: [April 14, 2016, 9:11am UTC](https://discuss.elastic.co/t/filebeat-service-hangs-on-first-start-amazon-ec2/46436/14 "2016-04-14T09:11:21Z")

</div>

Let me try to produce one.

---

<div class="post-metadata">

### Author: ![bmiramont](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bmiramont/32/8906_2.png) [@bmiramont](https://discuss.elastic.co/u/bmiramont)
#### Post date: [April 14, 2016, 9:11am UTC](https://discuss.elastic.co/t/filebeat-service-hangs-on-first-start-amazon-ec2/46436/15 "2016-04-14T09:11:43Z")

</div>

great !!

---

<div class="post-metadata">

### Author: ![bmiramont](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bmiramont/32/8906_2.png) [@bmiramont](https://discuss.elastic.co/u/bmiramont)
#### Post date: [April 14, 2016, 9:22am UTC](https://discuss.elastic.co/t/filebeat-service-hangs-on-first-start-amazon-ec2/46436/16 "2016-04-14T09:22:04Z")

</div>

service is running on one instance but not on another one. even when I start manually.  
I'll put the log and post them here

---

<div class="post-metadata">

### Author: ![bmiramont](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bmiramont/32/8906_2.png) [@bmiramont](https://discuss.elastic.co/u/bmiramont)
#### Post date: [April 14, 2016, 9:25am UTC](https://discuss.elastic.co/t/filebeat-service-hangs-on-first-start-amazon-ec2/46436/17 "2016-04-14T09:25:22Z")

</div>

ok, strange thing.  
here is the output of my command:

```auto
[ec2-user@ip-172-32-10-167 ~]$ sudo service topbeat status
topbeat-god dead but pid file exists

but he service is working: 
2016-04-14T09:24:10Z DBG output worker: publish 107 events
2016-04-14T09:24:10Z DBG Try to publish 107 events to logstash with window size 106
2016-04-14T09:24:10Z DBG 106 events out of 107 events sent to logstash. Continue sending ...
2016-04-14T09:24:10Z DBG Try to publish 1 events to logstash with window size 106
2016-04-14T09:24:10Z DBG 1 events out of 1 events sent to logstash. Continue sending ...
2016-04-14T09:24:10Z DBG send completed

```

---

<div class="post-metadata">

### Author: ![bmiramont](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bmiramont/32/8906_2.png) [@bmiramont](https://discuss.elastic.co/u/bmiramont)
#### Post date: [April 14, 2016, 9:26am UTC](https://discuss.elastic.co/t/filebeat-service-hangs-on-first-start-amazon-ec2/46436/18 "2016-04-14T09:26:04Z")

</div>

I'll deploy to a fresh environment when I'll have the rpm and we'll have a confirmation that it works

---

<div class="post-metadata">

### Author: ![tudor](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tudor/32/3753_2.png) [@tudor](https://discuss.elastic.co/u/tudor)
#### Post date: [April 14, 2016, 9:26am UTC](https://discuss.elastic.co/t/filebeat-service-hangs-on-first-start-amazon-ec2/46436/19 "2016-04-14T09:26:23Z")

</div>

Yeah, it's best to wait for the RPM and try on a fresh system I think.

---

<div class="post-metadata">

### Author: ![bmiramont](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bmiramont/32/8906_2.png) [@bmiramont](https://discuss.elastic.co/u/bmiramont)
#### Post date: [April 14, 2016, 9:27am UTC](https://discuss.elastic.co/t/filebeat-service-hangs-on-first-start-amazon-ec2/46436/20 "2016-04-14T09:27:39Z")

</div>

yep.  
there is several processes running so no wonder the beahvior is strange 🙂  
[ec2-user@ip-172-32-10-167 ~]$ ps -edf | grep beat  
root 2693 1 0 09:03 ? 00:00:00 filebeat-god -r / -n -p /var/run/filebeat.pid -- /usr/bin/filebeat -c /etc/filebeat/filebeat.yml  
root 2694 2693 0 09:03 ? 00:00:00 /usr/bin/filebeat -c /etc/filebeat/filebeat.yml  
root 2736 1 0 09:03 ? 00:00:00 topbeat-god -r / -n -p /var/run/topbeat.pid -- /usr/bin/topbeat -c /etc/topbeat/topbeat.yml  
root 2737 2736 0 09:03 ? 00:00:04 /usr/bin/topbeat -c /etc/topbeat/topbeat.yml  
root 3100 1 0 09:04 ? 00:00:00 topbeat-god -r / -n -p /var/run/topbeat.pid -- /usr/bin/topbeat -c /etc/topbeat/topbeat.yml  
root 3103 3100 0 09:04 ? 00:00:04 /usr/bin/topbeat -c /etc/topbeat/topbeat.yml  
root 3650 1 0 09:18 ? 00:00:00 filebeat-god -r / -n -p /var/run/filebeat.pid -- /usr/bin/filebeat -c /etc/filebeat/filebeat.yml  
root 3651 3650 0 09:18 ? 00:00:00 /usr/bin/filebeat -c /etc/filebeat/filebeat.yml  
root 3696 1 0 09:18 ? 00:00:00 topbeat-god -r / -n -p /var/run/topbeat.pid -- /usr/bin/topbeat -c /etc/topbeat/topbeat.yml  
root 3697 3696 0 09:18 ? 00:00:01 /usr/bin/topbeat -c /etc/topbeat/topbeat.yml  
root 4181 1 0 09:20 ? 00:00:00 filebeat-god -r / -n -p /var/run/filebeat.pid -- /usr/bin/filebeat -c /etc/filebeat/filebeat.yml  
root 4182 4181 0 09:20 ? 00:00:00 /usr/bin/filebeat -c /etc/filebeat/filebeat.yml  
root 4259 1 0 09:21 ? 00:00:00 filebeat-god -r / -n -p /var/run/filebeat.pid -- /usr/bin/filebeat -c /etc/filebeat/filebeat.yml  
root 4260 4259 0 09:21 ? 00:00:00 /usr/bin/filebeat -c /etc/filebeat/filebeat.yml  
root 4391 1 0 09:23 ? 00:00:00 topbeat-god -r / -n -p /var/run/topbeat.pid -- /usr/bin/topbeat -c /etc/topbeat/topbeat.yml  
root 4392 4391 0 09:23 ? 00:00:00 /usr/bin/topbeat -c /etc/topbeat/topbeat.yml  
ec2-user 4531 2507 0 09:26 pts/0 00:00:00 grep --color=auto beat

[Next page](https://discuss.elastic.co/t/filebeat-service-hangs-on-first-start-amazon-ec2/46436.md?page=2)
