# Filebeat stop collecting the container logs while the service keeps running!

**URL:** <https://discuss.elastic.co/t/filebeat-stop-collecting-the-container-logs-while-the-service-keeps-running/203596>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [October 15, 2019, 8:59am UTC](https://discuss.elastic.co/t/filebeat-stop-collecting-the-container-logs-while-the-service-keeps-running/203596 "2019-10-15T08:59:53Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Suresh\_Pal](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/suresh_pal/32/31571_2.png) [@Suresh\_Pal](https://discuss.elastic.co/u/Suresh_Pal)\
**Post date:** [October 15, 2019, 8:59am UTC](https://discuss.elastic.co/t/filebeat-stop-collecting-the-container-logs-while-the-service-keeps-running/203596/1 "2019-10-15T08:59:53Z")

</div>

Hi team,

Filebeat stop collecting the container logs while the service keeps running !! When i restart the service it again start collecting .  
PFA filebeat.yml

filebeat.prospectors:

# Each - is a prospector. Most options can be set at the prospector level, so

# you can use different prospectors for various configurations.

# Below are the prospector specific configurations.

- type: log

Please help as i'm loosing my log data.

Thanks,  
Suresh

---

<div class="post-metadata">

**Author:** ![shaunak](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shaunak/32/6643_2.png) [@shaunak](https://discuss.elastic.co/u/shaunak)\
**Post date:** [October 15, 2019, 5:30pm UTC](https://discuss.elastic.co/t/filebeat-stop-collecting-the-container-logs-while-the-service-keeps-running/203596/2 "2019-10-15T17:30:50Z")

</div>

Are there any errors or warnings in the Filebeat log at the moment it stops collecting the data?

Shaunak

---

<div class="post-metadata">

**Author:** ![Suresh\_Pal](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/suresh_pal/32/31571_2.png) [@Suresh\_Pal](https://discuss.elastic.co/u/Suresh_Pal)\
**Post date:** [October 16, 2019, 11:59am UTC](https://discuss.elastic.co/t/filebeat-stop-collecting-the-container-logs-while-the-service-keeps-running/203596/3 "2019-10-16T11:59:05Z")

</div>

There is nothing found in logs, it mostly happened when the container switch takes place.

---

<div class="post-metadata">

**Author:** ![Suresh\_Pal](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/suresh_pal/32/31571_2.png) [@Suresh\_Pal](https://discuss.elastic.co/u/Suresh_Pal)\
**Post date:** [October 16, 2019, 12:09pm UTC](https://discuss.elastic.co/t/filebeat-stop-collecting-the-container-logs-while-the-service-keeps-running/203596/4 "2019-10-16T12:09:41Z")

</div>

As per logs harvestor does not harvest any file when i restart the it again start harvesting the container logs

---

<div class="post-metadata">

**Author:** ![Suresh\_Pal](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/suresh_pal/32/31571_2.png) [@Suresh\_Pal](https://discuss.elastic.co/u/Suresh_Pal)\
**Post date:** [October 23, 2019, 8:52am UTC](https://discuss.elastic.co/t/filebeat-stop-collecting-the-container-logs-while-the-service-keeps-running/203596/5 "2019-10-23T08:52:19Z")

</div>

These are the filebeat logs running on the host.

e4a50179f60e3962ca21cf053f90d4f60801789be2f0155b3337fc1715781c-json.log  
2019-10-23T08:49:38.310Z DEBUG [prospector] log/prospector.go:168 Prospector states cleaned up. Before: 4, After: 4, Pending: 0  
2019-10-23T08:49:42.555Z DEBUG [docker] docker/watcher.go:207 Got a new docker event: {exec\_create: /bin/sh -c curl --fail -s [http://localhost:8090/manage-social/actuator/health](http://localhost:8090/manage-social/actuator/health) || exit 1 3080192e485362f127d0c783aed4e8ea4356d75e03679f53110de9d61544dfa6 [524350357552.dkr.ecr.us-east-1.amazonaws.com/msa-usa/fcsky-social-integration:97](http://524350357552.dkr.ecr.us-east-1.amazonaws.com/msa-usa/fcsky-social-integration:97) container exec\_create: /bin/sh -c curl --fail -s [http://localhost:8090/manage-social/actuator/health](http://localhost:8090/manage-social/actuator/health) || exit 1 {3080192e485362f127d0c783aed4e8ea4356d75e03679f53110de9d61544dfa6 map[com.amazonaws.ecs.container-name:fcsky-social-integration-usa com.amazonaws.ecs.task-arn:arn:aws:ecs:us-east-1:524350357552:task/7e6f527c-a846-415b-abb5-93e101321497 com.amazonaws.ecs.task-definition-family:fcsky-social-integration-usa com.amazonaws.ecs.task-definition-version:10 execID:f2c3ad4cccd92740e0e256e91786877f2cede06502c896456e914f5ef580d140 image:524350357552.dkr.ecr.us-east-1.amazonaws.com/msa-usa/fcsky-social-integration:97 name:ecs-fcsky-social-integration-usa-10-fcsky-social-integration-usa-a0f8caa58eabc9a02d00 com.amazonaws.ecs.cluster:ECS-USA]} local 1571820582 1571820582555482825}  
2019-10-23T08:49:42.555Z DEBUG [docker] docker/watcher.go:207 Got a new docker event: {exec\_start: /bin/sh -c curl --fail -s [http://localhost:8090/manage-social/actuator/health](http://localhost:8090/manage-social/actuator/health) || exit 1 3080192e485362f127d0c783aed4e8ea4356d75e03679f53110de9d61544dfa6 [524350357552.dkr.ecr.us-east-1.amazonaws.com/msa-usa/fcsky-social-integration:97](http://524350357552.dkr.ecr.us-east-1.amazonaws.com/msa-usa/fcsky-social-integration:97) container exec\_start: /bin/sh -c curl --fail -s [http://localhost:8090/manage-social/actuator/health](http://localhost:8090/manage-social/actuator/health) || exit 1 {3080192e485362f127d0c783aed4e8ea4356d75e03679f53110de9d61544dfa6 map[com.amazonaws.ecs.task-definition-family:fcsky-social-integration-usa com.amazonaws.ecs.task-definition-version:10 execID:f2c3ad4cccd92740e0e256e91786877f2cede06502c896456e914f5ef580d140 image:524350357552.dkr.ecr.us-east-1.amazonaws.com/msa-usa/fcsky-social-integration:97 name:ecs-fcsky-social-integration-usa-10-fcsky-social-integration-usa-a0f8caa58eabc9a02d00 com.amazonaws.ecs.cluster:ECS-USA com.amazonaws.ecs.container-name:fcsky-social-integration-usa com.amazonaws.ecs.task-arn:arn:aws:ecs:us-east-1:524350357552:task/7e6f527c-a846-415b-abb5-93e101321497]} local 1571820582 1571820582555635691}  
2019-10-23T08:49:42.579Z DEBUG [docker] docker/watcher.go:207 Got a new docker

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 20, 2019, 8:52am UTC](https://discuss.elastic.co/t/filebeat-stop-collecting-the-container-logs-while-the-service-keeps-running/203596/6 "2019-11-20T08:52:26Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
