# Filebeat stops forwarding logs to Logstash after setting max harvesters

**URL:** <https://discuss.elastic.co/t/filebeat-stops-forwarding-logs-to-logstash-after-setting-max-harvesters/108700>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [November 22, 2017, 11:27am UTC](https://discuss.elastic.co/t/filebeat-stops-forwarding-logs-to-logstash-after-setting-max-harvesters/108700 "2017-11-22T11:27:55Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![ntviet18](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ntviet18/32/24565_2.png) [@ntviet18](https://discuss.elastic.co/u/ntviet18)\
**Post date:** [November 22, 2017, 11:27am UTC](https://discuss.elastic.co/t/filebeat-stops-forwarding-logs-to-logstash-after-setting-max-harvesters/108700/1 "2017-11-22T11:27:55Z")

</div>

Due to some resource limitations I have to set maximum number of Filebeat harvesters. But after that change there are no more logs forwarded to Logstash.

Here are some logs from Filebeat

> 2017/11/22 11:13:56.421773 prospector\_log.go:248: ERR Harvester could not be started on new file: /var/audit/service.audit, Err: Harvester limit reached.  
> 2017/11/22 11:14:00.863862 metrics.go:39: INFO Non-zero metrics in the last 30s: filebeat.harvester.skipped=1332

---

<div class="post-metadata">

**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\
**Post date:** [November 23, 2017, 9:49am UTC](https://discuss.elastic.co/t/filebeat-stops-forwarding-logs-to-logstash-after-setting-max-harvesters/108700/2 "2017-11-23T09:49:42Z")

</div>

Please share you config file and some more complete logs. How many active files is filebeat monitoring (check with `lsof`).

Please format logs and config files using the `</>` button or 3 back-ticks.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 21, 2017, 9:49am UTC](https://discuss.elastic.co/t/filebeat-stops-forwarding-logs-to-logstash-after-setting-max-harvesters/108700/3 "2017-12-21T09:49:52Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.