# Filebeat stops harvesting files after logrotate

**URL:** <https://discuss.elastic.co/t/filebeat-stops-harvesting-files-after-logrotate/257013>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [November 30, 2020, 1:27am UTC](https://discuss.elastic.co/t/filebeat-stops-harvesting-files-after-logrotate/257013 "2020-11-30T01:27:50Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![\_Sree](https://avatars.discourse-cdn.com/v4/letter/_/b3f665/32.png) [@\_Sree](https://discuss.elastic.co/u/_Sree)\
**Post date:** [November 30, 2020, 1:27am UTC](https://discuss.elastic.co/t/filebeat-stops-harvesting-files-after-logrotate/257013/1 "2020-11-30T01:27:50Z")

</div>

I'm using wazuh kibana plugin and using filebeat to ship alerts to elasticsearch. Filebeat stop indexing data to wazuh-alerts index daily at midnight. I will be able to see new data only after restarting filebeat and it will start indexing data till midnight 12:00 AM, again I need to restart filebeat to get the data indexed to eleasticsearch. I can see that old alerts.json files are moved to archive folder by wazuh logrotate and newly created alerts.json file got new inode number. How to fix this issue without restartiing filebeat, I coudn't find any erros in elasticseatch and filebeat logs.

---

<div class="post-metadata">

**Author:** ![ChrsMark](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/chrsmark/32/55858_2.png) [@ChrsMark](https://discuss.elastic.co/u/ChrsMark)\
**Post date:** [November 30, 2020, 12:38pm UTC](https://discuss.elastic.co/t/filebeat-stops-harvesting-files-after-logrotate/257013/2 "2020-11-30T12:38:14Z")

</div>

Hi!

It could be an issue with log rotation. Can you check [https://www.elastic.co/guide/en/beats/filebeat/current/file-log-rotation.html](https://www.elastic.co/guide/en/beats/filebeat/current/file-log-rotation.html) and properly configure your Filebeat so as to handle log rotation?

C.

---

<div class="post-metadata">

**Author:** ![\_Sree](https://avatars.discourse-cdn.com/v4/letter/_/b3f665/32.png) [@\_Sree](https://discuss.elastic.co/u/_Sree)\
**Post date:** [December 1, 2020, 4:52am UTC](https://discuss.elastic.co/t/filebeat-stops-harvesting-files-after-logrotate/257013/3 "2020-12-01T04:52:34Z")

</div>

I have done like that in the doc but no change. Is this relevant in this scenario [https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-log.html#filebeat-input-log-close-timeout](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-log.html#filebeat-input-log-close-timeout)

---

<div class="post-metadata">

**Author:** ![ChrsMark](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/chrsmark/32/55858_2.png) [@ChrsMark](https://discuss.elastic.co/u/ChrsMark)\
**Post date:** [December 4, 2020, 9:50am UTC](https://discuss.elastic.co/t/filebeat-stops-harvesting-files-after-logrotate/257013/4 "2020-12-04T09:50:30Z")

</div>

Can you run Filebeat in debug mode and and share the logs in order to check the flow and why filebeat stops shipping?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 1, 2021, 11:50am UTC](https://discuss.elastic.co/t/filebeat-stops-harvesting-files-after-logrotate/257013/5 "2021-01-01T11:50:35Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.