# Filebeat stopped harvesting logs after a while

**URL:** https://discuss.elastic.co/t/filebeat-stopped-harvesting-logs-after-a-while/193298
**Category:** Beats
**Tags:** filebeat
**Created:** [August 1, 2019, 10:30am UTC](https://discuss.elastic.co/t/filebeat-stopped-harvesting-logs-after-a-while/193298 "2019-08-01T10:30:46Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![codersofthedark](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/codersofthedark/32/19406_2.png) [@codersofthedark](https://discuss.elastic.co/u/codersofthedark)
#### Post date: [August 1, 2019, 10:30am UTC](https://discuss.elastic.co/t/filebeat-stopped-harvesting-logs-after-a-while/193298/1 "2019-08-01T10:30:46Z")

</div>

We have filebeat 6.7.1 running as a daemonset on our kubernetes cluster. Everything was working fine till suddenly logs stopped popping up in ES.

When we checked filebeat logs, there was no ERROR but as filebeat there was nothing to harvest:

```json
2019-07-31T12:30:08.604Z INFO [monitoring] log/log.go:144 Non-zero metrics in the last 30s {"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":35080},"total":{"ticks":229250,"value":229250},"user":{"ticks":194170}},"handles":{"limit":{"hard":1048576,"soft":1048576},"open":5},"info":{"ephemeral_id":"91360383-6212-4667-90be-daef7d298991","uptime":{"ms":2579430011}},"memstats":{"gc_next":4194304,"memory_alloc":2155264,"memory_total":22969148448}},"filebeat":{"harvester":{"open_files":0,"running":0}},"libbeat":{"config":{"module":{"running":0}},"pipeline":{"clients":0,"events":{"active":0}}},"registrar":{"states":{"current":0}},"system":{"load":{"1":0.51,"15":0.26,"5":0.34,"norm":{"1":0.1275,"15":0.065,"5":0.085}}}}}} 

```

But no sooner we restarted the pod, logs started getting harvested and we could now see the logs in es.

Is this a known bug in the version we're using? How do we debug this further?

---

<div class="post-metadata">

### Author: ![justkind](https://avatars.discourse-cdn.com/v4/letter/j/919ad9/32.png) [@justkind](https://discuss.elastic.co/u/justkind)
#### Post date: [August 1, 2019, 4:19pm UTC](https://discuss.elastic.co/t/filebeat-stopped-harvesting-logs-after-a-while/193298/2 "2019-08-01T16:19:38Z")

</div>

Hmm might be a good idea to share your filebeat.yml config just for reference.

Maybe take a look at autodiscover, specifically the kubernetes section: [https://www.elastic.co/guide/en/beats/filebeat/6.7/configuration-autodiscover.html#\_kubernetes](https://www.elastic.co/guide/en/beats/filebeat/6.7/configuration-autodiscover.html#_kubernetes)

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 29, 2019, 4:19pm UTC](https://discuss.elastic.co/t/filebeat-stopped-harvesting-logs-after-a-while/193298/3 "2019-08-29T16:19:42Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
