Filebeat takes days to start outputting events to Logstash after a restart

Elastic Stack Beats
1

Hello everyone ,

Can any one please help me on this serious issue please . We have installed filebeat on PROD server and we have around 50K log files in it. If I restart Filebeat , it takes days to start outputting events to Logstash .If I delete my registry file, Filebeat will start sending events immediately.CPU usage by filebeat is also suspiciously high. I'm not sure what is happening.

Also i have to wait for atleast 3-4 days , so that filebeat will start injecting data to logtstash again. i am using 6.8.4 version.

I see below info in the debug logs.

2020-04-07T14:20:31.406+0200    DEBUG   [acker] beater/acker.go:64      stateful ack    {"count": 1}
2020-04-07T14:20:31.406+0200    DEBUG   [publish]       pipeline/client.go:193  Pipeline client receives callback 'onFilteredOut' for event: %+v{0001-01-01 00:00:00 +0000 UTC null null {851968-7591841-3327411174 true <nil> D:\Siebel\CACM4TEAIObjMgr_enu_0009_9446404_01.log 672 2020-04-07 12:47:22.7308932 +0200 CEST -1ns log map[] 851968-7591841-3327411174}}

So can any one please suggest me how can we avoid this issue ? , If i restart filebeat , i have to wait for 3-4 days so that filebeat will pick logs after that. Anyway , can we configure filebeat to pick logs immediately after restart without deleting registry file ?

Kindly help.

2

There is a note that seem related to this in the docs, but only for Filebeat 7.2 onwards , but I am not sure how much of that is also applicable to version 6.8.

3

Hello @Christian_Dahlqvist ,

Issue got fixed with setting flush to 60s in filebeat.

Thanks a lot for your reply anyways.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.