I’m using filebeat 8.18.3.When I run filebeat as linux service it doesn’t sends any logs to elasticsearch and logs constantly prints:Non zero metric found in last 30s. etc.At the beggining after loading configuration there is this fragment of log that informs about crawler stopping:
```{"log.level":"info","@timestamp":"2025-09-10T12:13:32.117+0200","log.logger":"crawler","log.origin":{"function":"github.com/elastic/beats/v7/filebeat/beater.(*crawler).startInput","file.name":"beater/crawler.go","file.line":117},"message":"starting input, keys present on the config: [filebeat.inputs.0.enabled filebeat.inputs.0.fields.dev_suffix filebeat.inputs.0.fields.dt_suffix filebeat.inputs.0.fields.preprod_suffix filebeat.inputs.0.fields.prod_suffix filebeat.inputs.0.fields.project_name filebeat.inputs.0.fields.project_type filebeat.inputs.0.fields.system_prefix filebeat.inputs.0.fields.uat_suffix filebeat.inputs.0.id filebeat.inputs.0.parsers.0.multiline.match filebeat.inputs.0.parsers.0.multiline.negate filebeat.inputs.0.parsers.0.multiline.pattern filebeat.inputs.0.paths.0 filebeat.inputs.0.pipeline filebeat.inputs.0.type]","service.name":"filebeat","ecs.version":"1.6.0"}Sep 10 12:13:32 2474-dev-ap-01.local.icacloud.com filebeat[3520236]: {"log.level":"info","@timestamp":"2025-09-10T12:13:32.117+0200","log.origin":{"function":"github.com/elastic/beats/v7/filebeat/beater.(*crawler).Stop","file.name":"beater/crawler.go","file.line":155},"message":"Stopping Crawler","service.name":"filebeat","ecs.version":"1.6.0"}Sep 10 12:13:32 2474-dev-ap-01.local.icacloud.com filebeat[3520236]: {"log.level":"info","@timestamp":"2025-09-10T12:13:32.117+0200","log.origin":{"function":"github.com/elastic/beats/v7/filebeat/beater.(*crawler).Stop","file.name":"beater/crawler.go","file.line":165},"message":"Stopping 0 inputs","service.name":"filebeat","ecs.version":"1.6.0"}Sep 10 12:13:32 2474-dev-ap-01.local.icacloud.com filebeat[3520236]: {"log.level":"info","@timestamp":"2025-09-10T12:13:32.117+0200","log.origin":{"function":"github.com/elastic/beats/v7/filebeat/beater.(*crawler).Stop","file.name":"beater/crawler.go","file.line":185},"message":"Crawler stopped","service.name":"filebeat","ecs.version":"1.6.0"}Sep 10 12:13:32 2474-dev-ap-01.local.icacloud.com filebeat[3520236]: {"log.level":"info","@timestamp":"2025-09-10T12:13:32.117+0200","log.logger":"registrar","log.origin":{"function":"github.com/elastic/beats/v7/filebeat/registrar.(*Registrar).Stop","file.name":"registrar/registrar.go","file.line":130},"message":"Stopping Registrar","service.name":"filebeat","ecs.version":"1.6.0"}Sep 10 12:13:32 2474-dev-ap-01.local.icacloud.com filebeat[3520236]: {"log.level":"info","@timestamp":"2025-09-10T12:13:32.117+0200","log.logger":"registrar","log.origin":{"function":"github.com/elastic/beats/v7/filebeat/registrar.(*Registrar).Run","file.name":"registrar/registrar.go","file.line":166},"message":"Ending Registrar","service.name":"filebeat","ecs.version":"1.6.0"}Sep 10 12:13:32 2474-dev-ap-01.local.icacloud.com filebeat[3520236]: {"log.level":"info","@timestamp":"2025-09-10T12:13:32.117+0200","log.logger":"registrar","log.origin":{"function":"github.com/elastic/beats/v7/filebeat/registrar.(*Registrar).Stop","file.name":"registrar/registrar.go","file.line":135},"message":"Registrar stopped","service.name":"filebeat","ecs.version":"1.6.0"}Sep 10 12:14:02 2474-dev-ap-01.local.icacloud.com filebeat[3520236]:```
When I run it from command line(exactly the same command I set the ExecStart of service to): it works as expected.The service runs as root.
ExecStart=/usr/share/filebeat/bin/filebeat -e -c /etc/filebeat/filebeat.yml
What can be a cause for that? How can I debug it further?