# FileBeat Service stops every night same time on most of our servers **URL:** \ **Category:** Beats\ **Tags:** filebeat\ **Created:** [April 13, 2018, 11:17am UTC](https://discuss.elastic.co/t/filebeat-service-stops-every-night-same-time-on-most-of-our-servers/127964 "2018-04-13T11:17:56Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![Hussain\_Kothari](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hussain_kothari/32/15739_2.png) [@Hussain\_Kothari](https://discuss.elastic.co/u/Hussain_Kothari)\ **Post date:** [April 13, 2018, 11:17am UTC](https://discuss.elastic.co/t/filebeat-service-stops-every-night-same-time-on-most-of-our-servers/127964/1 "2018-04-13T11:17:56Z")
I have installed Filebeat 5.2.0 on windows 2012 R2 server. The issue I have is the filebeat service stops at a particular time on most of our servers. The Log file does not have any error but just info. I have set the service startup type as automatic also have set Recovery after failure, but still for some reason service stops everyday and it doesn't restart. I have to manually start the service which is not desirable. Any help please? **Here is the Filebeat Config** filebeat.prospectors: - input\_type: log fields: environment: ${Server} platform: ${Platform} output.kafka: hosts: ["dummykafka:9092","dummykafka:9092"] topic: 'kafkatopic.IISLog' partition.round\_robin: reachable\_only: false required\_acks: 1 compression: gzip max\_message\_bytes: 1000000 **Here is the Error Log from one of the server** 2018-04-12T02:37:01-05:00 INFO Home path: [D:\Source\Filebeat] Config path: [D:\Source\Filebeat] Data path: [D:\Source\Filebeat\data] Logs path: [D:\Source\Filebeat\logs] 2018-04-12T02:37:01-05:00 INFO Setup Beat: filebeat; Version: 5.2.0 2018-04-12T02:37:01-05:00 INFO Activated kafka as output plugin. 2018-04-12T02:37:01-05:00 INFO Publisher name: mgowiauaq2 2018-04-12T02:37:01-05:00 INFO Flush Interval set to: 1s 2018-04-12T02:37:01-05:00 INFO Max Bulk Size set to: 2048 2018-04-12T02:37:01-05:00 INFO filebeat start running. 2018-04-12T02:37:01-05:00 INFO Registry file set to: D:\Source\Filebeat\data\registry 2018-04-12T02:37:01-05:00 INFO Loading registrar data from D:\Source\Filebeat\data\registry 2018-04-12T02:37:01-05:00 INFO States Loaded from registrar: 911 2018-04-12T02:37:01-05:00 INFO Loading Prospectors: 1 2018-04-12T02:37:01-05:00 INFO Start sending events to output 2018-04-12T02:37:01-05:00 INFO Starting spooler: spool\_size: 2048; idle\_timeout: 5s 2018-04-12T02:37:01-05:00 INFO Starting Registrar 2018-04-12T02:37:01-05:00 INFO Prospector with previous states loaded: 911 2018-04-12T02:37:01-05:00 INFO Loading Prospectors completed. Number of prospectors: 1 2018-04-12T02:37:01-05:00 INFO All prospectors are initialised and running with 911 states to persist 2018-04-12T02:37:01-05:00 INFO Starting prospector of type: log 2018-04-12T02:37:11-05:00 INFO Harvester started for file: D:\iislogs\abc\W3SVC10851\u\_ex180411.log 2018-04-12T02:37:11-05:00 INFO Harvester started for file: D:\iislogs\xyz\W3SVC10826\u\_ex180411.log 2018-04-12T02:37:11-05:00 INFO Harvester started for file: D:\iislogs\qwe\W3SVC10963\u\_ex180411.log 2018-04-12T02:37:11-05:00 INFO Harvester started for file: D:\iislogs\rty\W3SVC10949\u\_ex180411.log 2018-04-12T23:57:33-05:00 INFO No non-zero metrics in the last 30s 2018-04-12T23:58:03-05:00 INFO Non-zero metrics in the last 30s: libbeat.publisher.published\_events=364 publish.events=364 libbeat.kafka.call\_count.PublishEvents=2 libbeat.kafka.published\_and\_acked\_events=364 registrar.states.update=364 registrar.writes=2 2018-04-13T00:05:33-05:00 INFO No non-zero metrics in the last 30s 2018-04-13T00:06:03-05:00 INFO Non-zero metrics in the last 30s: libbeat.publisher.published\_events=364 registrar.states.update=364 libbeat.kafka.published\_and\_acked\_events=364 publish.events=364 libbeat.kafka.call\_count.PublishEvents=2 registrar.writes=2 2018-04-13T00:06:33-05:00 INFO No non-zero metrics in the last 30s 2018-04-13T00:07:03-05:00 INFO Non-zero metrics in the last 30s: registrar.writes=2 registrar.states.update=363 libbeat.kafka.call\_count.PublishEvents=2 libbeat.publisher.published\_events=363 libbeat.kafka.published\_and\_acked\_events=363 publish.events=363 2018-04-13T00:07:13-05:00 WARN client/metadata fetching metadata for all topics from broker dummykafkabroker:9092 2018-04-13T00:07:13-05:00 WARN Connected to broker at dummykafkabroker:9092 (registered as #2) 2018-04-13T00:27:33-05:00 INFO No non-zero metrics in the last 30s 2018-04-13T00:28:03-05:00 INFO Non-zero metrics in the last 30s: libbeat.kafka.published\_and\_acked\_events=364 libbeat.kafka.call\_count.PublishEvents=2 publish.events=364 registrar.states.update=364 registrar.writes=2 libbeat.publisher.published\_events=364 2018-04-13T00:28:33-05:00 INFO No non-zero metrics in the last 30s 2018-04-13T00:29:03-05:00 INFO Non-zero metrics in the last 30s: libbeat.kafka.call\_count.PublishEvents=2 libbeat.kafka.published\_and\_acked\_events=364 publish.events=364 libbeat.publisher.published\_events=364 registrar.states.update=364 registrar.writes=2 2018-04-13T00:29:33-05:00 INFO No non-zero metrics in the last 30s 2018-04-13T00:30:01-05:00 INFO Stopping filebeat 2018-04-13T00:30:01-05:00 INFO Stopping Crawler 2018-04-13T00:30:01-05:00 INFO Stopping 1 prospectors 2018-04-13T00:30:01-05:00 INFO Stopping Prospector 2018-04-13T00:30:01-05:00 INFO Reader was closed: D:\iislogs\abc\W3SVC10945\u\_ex180413.log. Closing. 2018-04-13T00:30:01-05:00 INFO Reader was closed: D:\iislogs\qwer\W3SVC10812\u\_ex180413.log. Closing. 2018-04-13T00:30:01-05:00 INFO Reader was closed: D:\iislogs\zxcv\W3SVC10806\u\_ex180413.log. Closing. 2018-04-13T00:30:01-05:00 INFO Prospector ticker stopped 2018-04-13T00:30:01-05:00 INFO Prospector channel stopped 2018-04-13T00:30:01-05:00 INFO Reader was closed: D:\iislogs\qwe\W3SVC10830\u\_ex180413.log. Closing. 2018-04-13T00:30:01-05:00 INFO Reader was closed: D:\iislogs\ert\W3SVC10930\u\_ex180413.log. Closing. 2018-04-13T00:30:01-05:00 INFO Reader was closed: D:\iislogs\sdf\W3SVC10987\u\_ex180413.log. Closing. 2018-04-13T00:30:01-05:00 INFO Crawler stopped 2018-04-13T00:30:01-05:00 INFO Stopping spooler 2018-04-13T00:30:01-05:00 INFO Stopping Registrar 2018-04-13T00:30:01-05:00 INFO Ending Registrar 2018-04-13T00:30:01-05:00 INFO Total non-zero values: registrar.writes=2070 publish.events=892472 libbeat.publisher.published\_events=890105 registar.states.current=911 registrar.states.cleanup=364 registrar.states.update=892472 libbeat.kafka.call\_count.PublishEvents=2061 libbeat.kafka.published\_and\_acked\_events=890105 filebeat.harvester.closed=546 filebeat.harvester.started=546 2018-04-13T00:30:01-05:00 INFO Uptime: 21h52m59.825078s 2018-04-13T00:30:01-05:00 INFO filebeat stopped. ---
**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\ **Post date:** [April 13, 2018, 4:00pm UTC](https://discuss.elastic.co/t/filebeat-service-stops-every-night-same-time-on-most-of-our-servers/127964/2 "2018-04-13T16:00:23Z")
It looks as if it received a signal to stop and a normal shutdown was executed. It's quite strange. > [@Hussain\_Kothari](#): > > tail\_files: true It's pretty unusual to see this in production. Probably you don't want that setting. > [@Hussain\_Kothari](#): > > Filebeat 5.2.0 Have you tried a newer release to see if this is occurring? ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [May 11, 2018, 4:00pm UTC](https://discuss.elastic.co/t/filebeat-service-stops-every-night-same-time-on-most-of-our-servers/127964/3 "2018-05-11T16:00:27Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.