# Filebeat stops until log rotated

**URL:** https://discuss.elastic.co/t/filebeat-stops-until-log-rotated/249083
**Category:** Beats
**Tags:** filebeat
**Created:** [September 18, 2020, 10:02am UTC](https://discuss.elastic.co/t/filebeat-stops-until-log-rotated/249083 "2020-09-18T10:02:03Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![Tuckson](https://avatars.discourse-cdn.com/v4/letter/t/f14d63/32.png) [@Tuckson](https://discuss.elastic.co/u/Tuckson)
#### Post date: [September 18, 2020, 10:02am UTC](https://discuss.elastic.co/t/filebeat-stops-until-log-rotated/249083/1 "2020-09-18T10:02:03Z")

</div>

Hi,

Have a filebeat 7.9.1 running on several CentOS 7 servers watching 1 log. This log is growing ca 150.000 to 200.000 bytes per second (12 to 15 GB a day at the moment). This log is copytruncated.

This issue is that at somepoint filebeat nolonger seems to send data. At first I thought logstash would be the issue, but the strange thing is that after a logrotate (we rotate the file when 4GB in size) the datadelivery is restored.

My fileeba.yml:

```auto
filebeat.inputs:
- type: log
  enabled: true

  paths:
    - /product/AGL/agl-core/logs/agl.log

  exclude_files: ['\.gz$']

  multiline.pattern: '^ts:'
  multiline.negate: true
  multiline.match: after

  tags: ["avs6", "api-log", "apigateway", "rt"]

  ignore_older: 48h
  close_inactive: 5m
  close_removed: true
  clean_removed: true
  scan_frequency: 10s
  harvester_limit: 4444

filebeat.config.modules:
  enabled: false
  # path: ${path.config}/modules.d/*.yml
  # reload.enabled: false

processors:
  - drop_fields:
      fields: ["host"]

fields:
  environment: production
  # environment: docker

queue.mem:
  events: 4096
  #flush.min_events: 1024
  #flush.timeout: 10s

output.logstash:
  enabled: true
  hosts: ["papps1479.ora.prd.itv.local:5044"]
  #hosts: ["papps1479.ora.prd.itv.local:5044","papps1480.ora.prd.itv.local:5044","papps1481.ora.prd.itv.local:5044"]
  loadbalance: true
  timeout: 1m
  #bulk_max_size: 2048
  slow_start: true

logging:
  level: info
  metrics:
    enabled: false

```

What might cause this isse?

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [October 16, 2020, 12:02pm UTC](https://discuss.elastic.co/t/filebeat-stops-until-log-rotated/249083/2 "2020-10-16T12:02:31Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.