# Filebeat stops tracing file

**URL:** <https://discuss.elastic.co/t/filebeat-stops-tracing-file/83761>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [April 26, 2017, 7:42pm UTC](https://discuss.elastic.co/t/filebeat-stops-tracing-file/83761 "2017-04-26T19:42:33Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Samuel\_Lima1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/samuel_lima1/32/101372_2.png) [@Samuel\_Lima1](https://discuss.elastic.co/u/Samuel_Lima1)\
**Post date:** [April 26, 2017, 7:42pm UTC](https://discuss.elastic.co/t/filebeat-stops-tracing-file/83761/1 "2017-04-26T19:42:33Z")

</div>

Hi,

I'm new to filebeat. I've read similar topics like this but none seems to solve my case.  
I'm starting filebeat in the command line to debug it before running it as a service.  
As it happens in the other topics like this, filebeat sends logs entries when it is started, but stops sending new entries thereafter.  
First I tested it with a real application log, but as it didn´t work, I created a script to keep adding lines to a file while filebeat process it.  
I´m testing output to console before logstash.

Folowing are the scripts and logs:

Script:

> for i in {1..1000}; do echo -e "{ "test": "$(date)" }" \>\> /tmp/somaEAR-srvclnSOMAxx.log; sleep 10; done

Some lines of the log file:

> { "test": "Wed Apr 26 16:33:41 -03 2017" }  
> { "test": "Wed Apr 26 16:33:51 -03 2017" }  
> { "test": "Wed Apr 26 16:34:01 -03 2017" }  
> { "test": "Wed Apr 26 16:34:11 -03 2017" }  
> { "test": "Wed Apr 26 16:34:21 -03 2017" }  
> { "test": "Wed Apr 26 16:34:31 -03 2017" }  
> { "test": "Wed Apr 26 16:34:41 -03 2017" }  
> { "test": "Wed Apr 26 16:34:51 -03 2017" }  
> { "test": "Wed Apr 26 16:35:01 -03 2017" }  
> { "test": "Wed Apr 26 16:35:11 -03 2017" }  
> { "test": "Wed Apr 26 16:35:21 -03 2017" }

filebeat.yml

> filebeat.prospectors:  
> - input\_type: log  
> paths:  
> - /tmp/somaEAR-srvclnSOMA\*  
> document\_type: somaear

> output.console:  
> pretty: true

> logging:

> level: debug  
> to\_syslog: false  
> to\_files: true  
> files:  
> path: /var/log/filebeat  
> name: filebeat.log  
> rotateeverybytes: 10485760 # = 10MB  
> keepfiles: 7

Log of filebeat running:

> [f0113886@li1576 filebeat]$ sudo /usr/bin/filebeat.sh -e -v -d '\*'  
> 2017/04/26 18:44:42.545233 beat.go:285: INFO Home path: [/usr/share/filebeat] Config path: [/etc/filebeat] Data path: [/var/lib/filebeat] Logs path: [/var/log/filebeat]  
> 2017/04/26 18:44:42.545281 beat.go:186: INFO Setup Beat: filebeat; Version: 5.3.0  
> 2017/04/26 18:44:42.545334 outputs.go:108: INFO Activated console as output plugin.  
> 2017/04/26 18:44:42.545425 publish.go:295: INFO Publisher name: li1576.portoseguro.brasil  
> 2017/04/26 18:44:42.545580 async.go:63: INFO Flush Interval set to: 1s  
> 2017/04/26 18:44:42.545604 async.go:64: INFO Max Bulk Size set to: 2048  
> 2017/04/26 18:44:42.545936 metrics.go:23: INFO Metrics logging every 30s  
> 2017/04/26 18:44:42.546099 beat.go:221: INFO filebeat start running.  
> 2017/04/26 18:44:42.546141 registrar.go:85: INFO Registry file set to: /var/lib/filebeat/registry  
> 2017/04/26 18:44:42.546177 registrar.go:106: INFO Loading registrar data from /var/lib/filebeat/registry  
> 2017/04/26 18:44:42.546233 registrar.go:123: INFO States Loaded from registrar: 0  
> 2017/04/26 18:44:42.546266 crawler.go:38: INFO Loading Prospectors: 1  
> 2017/04/26 18:44:42.546396 prospector\_log.go:61: INFO Prospector with previous states loaded: 0  
> 2017/04/26 18:44:42.546503 prospector.go:124: INFO Starting prospector of type: log; id: 14707180048950103318  
> 2017/04/26 18:44:42.546559 crawler.go:58: INFO Loading and starting Prospectors completed. Enabled prospectors: 1  
> 2017/04/26 18:44:42.546617 registrar.go:236: INFO Starting Registrar  
> 2017/04/26 18:44:42.546685 sync.go:41: INFO Start sending events to output  
> 2017/04/26 18:44:42.546767 spooler.go:63: INFO Starting spooler: spool\_size: 2048; idle\_timeout: 5s  
> 2017/04/26 18:44:42.547236 log.go:91: INFO Harvester started for file: /tmp/somaEAR-srvclnSOMAxx.log  
> {  
> "@timestamp": "2017-04-26T18:44:42.547Z",  
> "beat": {  
> "hostname": "li1576.portoseguro.brasil",  
> "name": "li1576.portoseguro.brasil",  
> "version": "5.3.0"  
> },  
> "input\_type": "log",  
> "message": "{ "test": "Wed Apr 26 15:44:29 -03 2017" }",  
> "offset": 43,  
> "source": "/tmp/somaEAR-srvclnSOMAxx.log",  
> "type": "somaear"  
> }  
> 2017/04/26 18:44:47.548286 console.go:83: CRIT Unable to publish events to console:   
> {  
> "@timestamp": "2017-04-26T18:44:42.547Z",  
> "beat": {  
> "hostname": "li1576.portoseguro.brasil",  
> "name": "li1576.portoseguro.brasil",  
> "version": "5.3.0"  
> },  
> "input\_type": "log",  
> "message": "{ "test": "Wed Apr 26 15:44:39 -03 2017" }",  
> "offset": 86,  
> "source": "/tmp/somaEAR-srvclnSOMAxx.log",  
> "type": "somaear"  
> }  
> 2017/04/26 18:44:47.548393 console.go:83: CRIT Unable to publish events to console:   
> 2017/04/26 18:45:12.546805 metrics.go:39: INFO Non-zero metrics in the last 30s: filebeat.harvester.open\_files=1 filebeat.harvester.running=1 filebeat.harvester.started=1 libbeat.publisher.published\_events=2  
> 2017/04/26 18:45:42.547414 metrics.go:34: INFO No non-zero metrics in the last 30s  
> 2017/04/26 18:46:12.547328 metrics.go:34: INFO No non-zero metrics in the last 30s  
> 2017/04/26 18:46:42.546811 metrics.go:34: INFO No non-zero metrics in the last 30s  
> 2017/04/26 18:47:12.547216 metrics.go:34: INFO No non-zero metrics in the last 30s  
> 2017/04/26 18:47:42.546848 metrics.go:34: INFO No non-zero metrics in the last 30s  
> 2017/04/26 18:48:12.547476 metrics.go:34: INFO No non-zero metrics in the last 30s  
> 2017/04/26 18:48:42.547008 metrics.go:34: INFO No non-zero metrics in the last 30s

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [April 26, 2017, 8:07pm UTC](https://discuss.elastic.co/t/filebeat-stops-tracing-file/83761/2 "2017-04-26T20:07:43Z")

</div>

> [@Samuel\_Lima1](#):
>
> console.go:83: CRIT Unable to publish events to console:

Try using the file output instead of the console. There was [bug](https://github.com/elastic/beats/issues/4041) affecting the console in 5.3.0.

---

<div class="post-metadata">

**Author:** ![Samuel\_Lima1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/samuel_lima1/32/101372_2.png) [@Samuel\_Lima1](https://discuss.elastic.co/u/Samuel_Lima1)\
**Post date:** [April 26, 2017, 8:30pm UTC](https://discuss.elastic.co/t/filebeat-stops-tracing-file/83761/3 "2017-04-26T20:30:39Z")

</div>

Thank you Andrew.

With file output it works.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 24, 2017, 8:34pm UTC](https://discuss.elastic.co/t/filebeat-stops-tracing-file/83761/4 "2017-05-24T20:34:27Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
