Filebeat stop sending logs

Elastic Stack Beats
1

Hi,

I have a problem, that after log rotate (my logs rotate every hour) after half hour it looks like that filebeat stop sending the logs to logstash, maybe someone can help me with this. My config:

#=========================== Filebeat prospectors =============================

filebeat.prospectors:

  • type: log

    enabled: true

    paths:

    • /ocs/mobicents/server/bite/log/ocs.log
      document_type: syslog

    close_timeout: 5m
    #=========================== Harvester closing options ========================
    #close_inactive: 5m
    #close_renamed: true
    #close_timeout: 5m

    Include lines. A list of regular expressions to match. It exports the lines that are

    matching any regular expression from the list.

    #include_lines: ['^ERR', '^WARN']

#============================= Filebeat modules ===============================

filebeat.config.modules:

Glob pattern for configuration loading

path: ${path.config}/modules.d/*.yml

Set to true to enable config reloading

reload.enabled: true

Period on which files under path should be checked for changes

#reload.period: 10s

#==================== Elasticsearch template setting ==========================

#setup.template.settings:
#index.number_of_shards: 3
#index.codec: best_compression
#_source.enabled: false

#================================ Outputs =====================================

Configure what output to use when sending the data collected by the beat.

#----------------------------- Logstash output --------------------------------
output.logstash:

The Logstash hosts

hosts: ["sssss.int.ss.lt:5043"]

2018-12-13T15:30:17.804+0200 INFO log/harvester.go:207 Closing harvester because close_timeout was reached.
2018-12-13T15:30:22.580+0200 INFO log/harvester.go:216 Harvester started for file: /ocs/mobicents/server/bite/log/ocs.log
2018-12-13T15:30:41.469+0200 INFO [monitoring] log/log.go:124 Non-zero metrics in the last 30s {"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":7086820,"time":7086821},"total":{"ticks":128412170,"time":128412172,"value":128412170},"user":{"ticks":121325350,"time":121325351}},"info":{"ephemeral_id":"3939b4f2-03f0-4275-ab9a-330364f240b0","uptime":{"ms":3280440014}},"memstats":{"gc_next":32170944,"memory_alloc":26375896,"memory_total":21543119041112,"rss":-2359296}},"filebeat":{"events":{"added":12290,"done":12290},"harvester":{"closed":1,"open_files":1,"running":1,"started":1}},"libbeat":{"config":{"module":{"running":0},"reloads":3},"output":{"events":{"acked":12288,"batches":9,"total":12288},"read":{"bytes":66},"write":{"bytes":2176745}},"pipeline":{"clients":1,"events":{"active":4117,"filtered":2,"published":12288,"total":12290},"queue":{"acked":12288}}},"registrar":{"states":{"current":1,"update":12290},"writes":7},"system":{"load":{"1":1.88,"15":1.73,"5":1.76,"norm":{"1":0.235,"15":0.2163,"5":0.22}}}}}}
2018-12-13T15:31:11.469+0200 INFO [monitoring] log/log.go:124 Non-zero metrics in the last 30s {"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":7086860,"time":7086861},"total":{"ticks":128412970,"time":128412974,"value":128412970},"user":{"ticks":121326110,"time":121326113}},"info":{"ephemeral_id":"3939b4f2-03f0-4275-ab9a-330364f240b0","uptime":{"ms":3280470013}},"memstats":{"gc_next":37991744,"memory_alloc":19230168,"memory_total":21543244531432}},"filebeat":{"events":{"added":12288,"done":12288},"harvester":{"open_files":1,"running":1}},"libbeat":{"config":{"module":{"running":0},"reloads":3},"output":{"events":{"acked":12288,"batches":9,"total":12288},"read":{"bytes":78},"write":{"bytes":2192618}},"pipeline":{"clients":1,"events":{"active":4117,"published":12288,"total":12288},"queue":{"acked":12288}}},"registrar":{"states":{"current":1,"update":12288},"writes":8},"system":{"load":{"1":1.61,"15":1.71,"5":1.7,"norm":{"1":0.2013,"15":0.2138,"5":0.2125}}}}}}
2018-12-13T15:31:41.469+0200 INFO [monitoring] log/log.go:124 Non-zero metrics in the last 30s {"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":7086890,"time":7086896},"total":{"ticks":128413760,"time":128413768,"value":128413760},"user":{"ticks":121326870,"time":121326872}},"info":{"ephemeral_id":"3939b4f2-03f0-4275-ab9a-330364f240b0","uptime":{"ms":3280500013}},"memstats":{"gc_next":31227072,"memory_alloc":28433128,"memory_total":21543369336024,"rss":262144}},"filebeat":{"events":{"added":12288,"done":12288},"harvester":{"open_files":1,"running":1}},"libbeat":{"config":{"module":{"running":0},"reloads":3},"output":{"events":{"acked":12288,"batches":9,"total":12288},"read":{"bytes":72},"write":{"bytes":2173865}},"pipeline":{"clients":1,"events":{"active":4117,"published":12288,"total":12288},"queue":{"acked":12288}}},"registrar":{"states":{"current":1,"update":12288},"writes":9},"system":{"load":{"1":1.75,"15":1.72,"5":1.73,"norm":{"1":0.2188,"15":0.215,"5":0.2163}}}}}}
2018-12-13T15:32:11.469+0200 INFO [monitoring] log/log.go:124 Non-zero metrics in the last 30s {"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":7086930,"time":7086932},"total":{"ticks":128414570,"time":128414572,"value":128414570},"user":{"ticks":121327640,"time":121327640}},"info":{"ephemeral_id":"3939b4f2-03f0-4275-ab9a-330364f240b0","uptime":{"ms":3280530013}},"memstats":{"gc_next":35109952,"memory_alloc":19161592,"memory_total":21543493933896}},"filebeat":{"events":{"added":12288,"done":12288},"harvester":{"open_files":1,"running":1}},"libbeat":{"config":{"module":{"running":0},"reloads":3},"output":{"events":{"acked":12288,"batches":9,"total":12288},"read":{"bytes":72},"write":{"bytes":2172910}},"pipeline":{"clients":1,"events":{"active":4117,"published":12288,"total":12288},"queue":{"acked":12288}}},"registrar":{"states":{"current":1,"update":12288},"writes":7},"system":{"load":{"1":1.57,"15":1.7,"5":1.69,"norm":{"1":0.1963,"15":0.2125,"5":0.2113}}}}}}

2

Also when i restart filebeat then everything start working fine again :slight_smile:

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.