# Filebeat takes days to start outputting events to Logstash after a restart

**URL:** <https://discuss.elastic.co/t/filebeat-takes-days-to-start-outputting-events-to-logstash-after-a-restart/226954>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [April 7, 2020, 4:31pm UTC](https://discuss.elastic.co/t/filebeat-takes-days-to-start-outputting-events-to-logstash-after-a-restart/226954 "2020-04-07T16:31:00Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Saravana37](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/saravana37/32/85237_2.png) [@Saravana37](https://discuss.elastic.co/u/Saravana37)\
**Post date:** [April 7, 2020, 4:31pm UTC](https://discuss.elastic.co/t/filebeat-takes-days-to-start-outputting-events-to-logstash-after-a-restart/226954/1 "2020-04-07T16:31:00Z")

</div>

Hello everyone ,

Can any one please help me on this serious issue please . We have installed filebeat on PROD server and we have around 50K log files in it. If I restart Filebeat , it takes days to start outputting events to Logstash .If I delete my registry file, Filebeat will start sending events immediately.CPU usage by filebeat is also suspiciously high. I'm not sure what is happening.

Also i have to wait for atleast 3-4 days , so that filebeat will start injecting data to logtstash again. i am using 6.8.4 version.

I see below info in the debug logs.

```
2020-04-07T14:20:31.406+0200 DEBUG [acker] beater/acker.go:64 stateful ack {"count": 1}
2020-04-07T14:20:31.406+0200 DEBUG [publish] pipeline/client.go:193 Pipeline client receives callback 'onFilteredOut' for event: %+v{0001-01-01 00:00:00 +0000 UTC null null {851968-7591841-3327411174 true <nil> D:\Siebel\CACM4TEAIObjMgr_enu_0009_9446404_01.log 672 2020-04-07 12:47:22.7308932 +0200 CEST -1ns log map[] 851968-7591841-3327411174}}

```

So can any one please suggest me how can we avoid this issue ? , If i restart filebeat , i have to wait for 3-4 days so that filebeat will pick logs after that. Anyway , can we configure filebeat to pick logs immediately after restart without deleting registry file ?

Kindly help.

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [April 13, 2020, 8:48am UTC](https://discuss.elastic.co/t/filebeat-takes-days-to-start-outputting-events-to-logstash-after-a-restart/226954/2 "2020-04-13T08:48:13Z")

</div>

There is [a note that seem related to this in the docs](https://www.elastic.co/guide/en/beats/filebeat/7.6/reduce-registry-size.html), but only for Filebeat 7.2 onwards , but I am not sure how much of that is also applicable to version 6.8.

---

<div class="post-metadata">

**Author:** ![Saravana37](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/saravana37/32/85237_2.png) [@Saravana37](https://discuss.elastic.co/u/Saravana37)\
**Post date:** [April 13, 2020, 12:21pm UTC](https://discuss.elastic.co/t/filebeat-takes-days-to-start-outputting-events-to-logstash-after-a-restart/226954/3 "2020-04-13T12:21:09Z")

</div>

Hello @Christian_Dahlqvist ,

Issue got fixed with setting flush to 60s in filebeat.

Thanks a lot for your reply anyways.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 11, 2020, 12:21pm UTC](https://discuss.elastic.co/t/filebeat-takes-days-to-start-outputting-events-to-logstash-after-a-restart/226954/4 "2020-05-11T12:21:14Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.