# Filebeat still sending logs even if service is stopped

**URL:** <https://discuss.elastic.co/t/filebeat-still-sending-logs-even-if-service-is-stopped/326029>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [February 21, 2023, 7:38am UTC](https://discuss.elastic.co/t/filebeat-still-sending-logs-even-if-service-is-stopped/326029 "2023-02-21T07:38:42Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Azkiel19](https://avatars.discourse-cdn.com/v4/letter/a/d26b3c/32.png) [@Azkiel19](https://discuss.elastic.co/u/Azkiel19)\
**Post date:** [February 21, 2023, 7:38am UTC](https://discuss.elastic.co/t/filebeat-still-sending-logs-even-if-service-is-stopped/326029/1 "2023-02-21T07:38:42Z")

</div>

Hi,

I'm new to Filebeats and the ELK stack.

To provide an overview, our setup uses:

Filebeat -\> sends to Logstash -\> sends to Elastic Search

I expected that once I turned off / stop the filebeat service from running - Logstash won't receive logs from it, and thus no inputs ingested in Elastic.

Yet even after stopping the service and monitoring for an hour - I can see logs coming in from that server.

I would expect the filebeat service to be machine based and not per user right?

Any insights is appreciated! Thank you! 🙂

---

<div class="post-metadata">

**Author:** ![Wave](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/wave/32/117242_2.png) [@Wave](https://discuss.elastic.co/u/Wave)\
**Post date:** [February 24, 2023, 4:43pm UTC](https://discuss.elastic.co/t/filebeat-still-sending-logs-even-if-service-is-stopped/326029/2 "2023-02-24T16:43:20Z")

</div>

You're right that filebeat as a service is usually setup on a machine basis. What is probably happening is maybe a manual filebeat process is still running somewhere. You can see what's running on your system (if unix based) with:

```auto
ps -aux | grep filebeat

```

The first command is going to list out all your processes and then pipe it to grep that will then return all filebeat processes with the name filebeat.

Hopefully you'll see a bunch of processes listed. If you only see one that says at the end "--color=auto filebeat" that means that machine isn't running any filebeat.

The other thing I'd double check is in kibana to make sure that some other host isn't sending data as well.

If you are still only seeing data come in from that host. A more drastic option, if you are able to, is to try safely powering down the filebeat host. If data is still coming in you'll know it's coming in from somewhere else. Good luck.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 24, 2023, 6:43pm UTC](https://discuss.elastic.co/t/filebeat-still-sending-logs-even-if-service-is-stopped/326029/3 "2023-03-24T18:43:21Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.