# Filebeat stops crawler when run as linux service **URL:** \ **Category:** Beats\ **Tags:** filebeat\ **Created:** [September 10, 2025, 11:08am UTC](https://discuss.elastic.co/t/filebeat-stops-crawler-when-run-as-linux-service/381836 "2025-09-10T11:08:31Z")\ **Posts on this page:** 2\ **Page:** 1
**Author:** ![WERTYASDFGH](https://avatars.discourse-cdn.com/v4/letter/w/ccd318/32.png) [@WERTYASDFGH](https://discuss.elastic.co/u/WERTYASDFGH)\ **Post date:** [September 10, 2025, 11:08am UTC](https://discuss.elastic.co/t/filebeat-stops-crawler-when-run-as-linux-service/381836/1 "2025-09-10T11:08:31Z")
I’m using filebeat 8.18.3.When I run filebeat as linux service it doesn’t sends any logs to elasticsearch and logs constantly prints:Non zero metric found in last 30s. etc.At the beggining after loading configuration there is this fragment of log that informs about crawler stopping: ```{"log.level":"info","@timestamp":"2025-09-10T12:13:32.117+0200","log.logger":"crawler","log.origin":{"function":"[github.com/elastic/beats/v7/filebeat/beater.(\*crawler).startInput","file.name":"beater/crawler.go","file.line":117},"message":"starting](http://github.com/elastic/beats/v7/filebeat/beater.(*crawler).startInput%22,%22file.name%22:%22beater/crawler.go%22,%22file.line%22:117%7D,%22message%22:%22starting) input, keys present on the config: [filebeat.inputs.0.enabled filebeat.inputs.0.fields.dev\_suffix filebeat.inputs.0.fields.dt\_suffix filebeat.inputs.0.fields.preprod\_suffix filebeat.inputs.0.fields.prod\_suffix filebeat.inputs.0.fields.project\_name filebeat.inputs.0.fields.project\_type filebeat.inputs.0.fields.system\_prefix filebeat.inputs.0.fields.uat\_suffix filebeat.inputs.0.id filebeat.inputs.0.parsers.0.multiline.match filebeat.inputs.0.parsers.0.multiline.negate filebeat.inputs.0.parsers.0.multiline.pattern filebeat.inputs.0.paths.0 filebeat.inputs.0.pipeline filebeat.inputs.0.type]","service.name":"filebeat","ecs.version":"1.6.0"}Sep 10 12:13:32 [2474-dev-ap-01.local.icacloud.com](http://2474-dev-ap-01.local.icacloud.com) filebeat[3520236]: {"log.level":"info","@timestamp":"2025-09-10T12:13:32.117+0200","log.origin":{"function":"[github.com/elastic/beats/v7/filebeat/beater.](http://github.com/elastic/beats/v7/filebeat/beater.)(\*crawler).Stop","file.name":"beater/crawler.go","file.line":155},"message":"Stopping Crawler","service.name":"filebeat","ecs.version":"1.6.0"}Sep 10 12:13:32 [2474-dev-ap-01.local.icacloud.com](http://2474-dev-ap-01.local.icacloud.com) filebeat[3520236]: {"log.level":"info","@timestamp":"2025-09-10T12:13:32.117+0200","log.origin":{"function":"[github.com/elastic/beats/v7/filebeat/beater.](http://github.com/elastic/beats/v7/filebeat/beater.)(\*crawler).Stop","file.name":"beater/crawler.go","file.line":165},"message":"Stopping 0 inputs","service.name":"filebeat","ecs.version":"1.6.0"}Sep 10 12:13:32 [2474-dev-ap-01.local.icacloud.com](http://2474-dev-ap-01.local.icacloud.com) filebeat[3520236]: {"log.level":"info","@timestamp":"2025-09-10T12:13:32.117+0200","log.origin":{"function":"[github.com/elastic/beats/v7/filebeat/beater.](http://github.com/elastic/beats/v7/filebeat/beater.)(\*crawler).Stop","file.name":"beater/crawler.go","file.line":185},"message":"Crawler stopped","service.name":"filebeat","ecs.version":"1.6.0"}Sep 10 12:13:32 [2474-dev-ap-01.local.icacloud.com](http://2474-dev-ap-01.local.icacloud.com) filebeat[3520236]: {"log.level":"info","@timestamp":"2025-09-10T12:13:32.117+0200","log.logger":"registrar","log.origin":{"function":"[github.com/elastic/beats/v7/filebeat/registrar.](http://github.com/elastic/beats/v7/filebeat/registrar.)(\*Registrar).Stop","file.name":"registrar/registrar.go","file.line":130},"message":"Stopping Registrar","service.name":"filebeat","ecs.version":"1.6.0"}Sep 10 12:13:32 [2474-dev-ap-01.local.icacloud.com](http://2474-dev-ap-01.local.icacloud.com) filebeat[3520236]: {"log.level":"info","@timestamp":"2025-09-10T12:13:32.117+0200","log.logger":"registrar","log.origin":{"function":"[github.com/elastic/beats/v7/filebeat/registrar.](http://github.com/elastic/beats/v7/filebeat/registrar.)(\*Registrar).Run","file.name":"registrar/registrar.go","file.line":166},"message":"Ending Registrar","service.name":"filebeat","ecs.version":"1.6.0"}Sep 10 12:13:32 [2474-dev-ap-01.local.icacloud.com](http://2474-dev-ap-01.local.icacloud.com) filebeat[3520236]: {"log.level":"info","@timestamp":"2025-09-10T12:13:32.117+0200","log.logger":"registrar","log.origin":{"function":"[github.com/elastic/beats/v7/filebeat/registrar.](http://github.com/elastic/beats/v7/filebeat/registrar.)(\*Registrar).Stop","file.name":"registrar/registrar.go","file.line":135},"message":"Registrar stopped","service.name":"filebeat","ecs.version":"1.6.0"}Sep 10 12:14:02 [2474-dev-ap-01.local.icacloud.com](http://2474-dev-ap-01.local.icacloud.com) filebeat[3520236]:``` When I run it from command line(exactly the same command I set the ExecStart of service to): it works as expected.The service runs as root. `ExecStart=/usr/share/filebeat/bin/filebeat -e -c /etc/filebeat/filebeat.yml` What can be a cause for that? How can I debug it further? ---
**Author:** ![WERTYASDFGH](https://avatars.discourse-cdn.com/v4/letter/w/ccd318/32.png) [@WERTYASDFGH](https://discuss.elastic.co/u/WERTYASDFGH)\ **Post date:** [September 11, 2025, 12:28pm UTC](https://discuss.elastic.co/t/filebeat-stops-crawler-when-run-as-linux-service/381836/2 "2025-09-11T12:28:28Z")
turns out I had typo in reference to environmental variable name in fields section of filebeat.yml. I’m pretty sure when I had this earlier it just threw error and stopped service instead of just running without any crawlers so I assumed it’s not it. Well, 2 days lost.