# Filebeat stops sending logs, but with no errors, service is running

**URL:** <https://discuss.elastic.co/t/filebeat-stops-sending-logs-but-with-no-errors-service-is-running/82765>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [April 18, 2017, 7:39pm UTC](https://discuss.elastic.co/t/filebeat-stops-sending-logs-but-with-no-errors-service-is-running/82765 "2017-04-18T19:39:08Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![rswestmoreland](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rswestmoreland/32/17476_2.png) [@rswestmoreland](https://discuss.elastic.co/u/rswestmoreland)\
**Post date:** [April 18, 2017, 7:39pm UTC](https://discuss.elastic.co/t/filebeat-stops-sending-logs-but-with-no-errors-service-is-running/82765/1 "2017-04-18T19:39:08Z")

</div>

Ran into a weird issue. I have Filebeat picking up logs on a centos7 vm and sending them over to instances of Graylog using the Logstash output.

I having Metricbeat and Packetbeat saving to disk, so Filebeat would pick up their logs along with the rest of the linux logs.

Filebeat will work for awhile and then just stop forwarding any logs. If I restart Filebeat, it will then send again picking up where it left off, until it just stops again. The service still appears to be running and there is no indication of an error in the filebeat log file. Instead I get just this repeating:

2017-04-18T19:05:20Z INFO No non-zero metrics in the last 30s

I'm running Filebeat version 5.1.2.

Here is my Prospector configuration:

- input\_type: log  
paths:
  - /var/log/\*
  - /var/log/_/_.log  
exclude\_files: ['.gz$', '.bz2$', '.zip$', '.tar$', 'filebeat']  
ignore\_older: 96h

I was trying out different backoff, close, clean options but commented them all out to rule out an error from these and just use defaults.

The /var/lib/filebeat/registry timestamp stops at the same time. It is only 7.4K in size, I count only 50 sources being tracked in it.

In case this is helpful, metric and packet logs are only 10M before rotating, and include\_fields are keeping the json output a lot leaner than default.

As a test, I shutoff metric and packetbeat. Restarted filebeat. Waited until it kept repeating the non-zero metrics message. Started Metricbeat. In the filebeat log I then see "Non-zero metrics in the last 30s: filebeat.harvester.open\_files=1". Then the next messages again are No non-zero metrics, and I don't get anything on the Graylog side.

In my logstash output, I have 2 hosts, loadbalance is true, worker is 2, pipelining is 2, timeout is 10, max\_retries is 65500.

If it was a connectivity issue, wouldn't I be seeing a recurring error about it, especially with the high max retries?

Thanks in advance for any suggestions -

---

<div class="post-metadata">

**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\
**Post date:** [April 20, 2017, 9:45am UTC](https://discuss.elastic.co/t/filebeat-stops-sending-logs-but-with-no-errors-service-is-running/82765/2 "2017-04-20T09:45:34Z")

</div>

Can you share full configs and log output (please format using the `</>`-button)? Have you checked beats having a connection to logstash/graylog via `netstat` (or `ss` tool)?

Did you test filebeat outputing to file or console without sending to graylog?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 18, 2017, 9:52am UTC](https://discuss.elastic.co/t/filebeat-stops-sending-logs-but-with-no-errors-service-is-running/82765/3 "2017-05-18T09:52:37Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.