Filebeat throwing error while run the files

Elastic Stack Beats
1

Hi,
when i run my filebeat file im getting following error plz help to resolve it,

goroutine 49260 [runnable]:
syscall.Syscall(0x0, 0x6028, 0xc8e08a8000, 0x4000, 0x1826, 0x4000, 0x0)
        /usr/local/go/src/syscall/asm_linux_amd64.s:18 +0x5
syscall.read(0x6028, 0xc8e08a8000, 0x4000, 0x4000, 0xc87beb63f0, 0x0, 0x0)
        /usr/local/go/src/syscall/zsyscall_linux_amd64.go:783 +0x5f
syscall.Read(0x6028, 0xc8e08a8000, 0x4000, 0x4000, 0x0, 0x0, 0x0)
        /usr/local/go/src/syscall/syscall_unix.go:160 +0x4d
os.(*File).read(0xc8af6189b0, 0xc8e08a8000, 0x4000, 0x4000, 0x0, 0x0, 0x0)
        /usr/local/go/src/os/file_unix.go:211 +0x53
os.(*File).Read(0xc8af6189b0, 0xc8e08a8000, 0x4000, 0x4000, 0x0, 0x0, 0x0)
        /usr/local/go/src/os/file.go:95 +0x8a
github.com/elastic/beats/filebeat/harvester.fileSource.Read(0xc8af6189b0, 0xc8e08a8000, 0x4000, 0x4000, 0x0, 0x0, 0x0)
        <autogenerated>:43 +0x63
github.com/elastic/beats/filebeat/harvester.(*logFileReader).Read(0xc89a797420, 0xc8e08a8000, 0x4000, 0x4000, 0x4000, 0x0, 0x0)
        /go/src/github.com/elastic/beats/filebeat/harvester/reader.go:74 +0x1d8
github.com/elastic/beats/filebeat/harvester/encoding.(*LineReader).advance(0xc89a797490, 0x0, 0x0)
        /go/src/github.com/elastic/beats/filebeat/harvester/encoding/reader.go:118 +0x43e
github.com/elastic/beats/filebeat/harvester/encoding.(*LineReader).Next(0xc89a797490, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
        /go/src/github.com/elastic/beats/filebeat/harvester/encoding/reader.go:67 +0x5c
github.com/elastic/beats/filebeat/harvester/processor.LineSource.Next(0xc89a797490, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
        /go/src/github.com/elastic/beats/filebeat/harvester/processor/processor.go:58 +0x6d
github.com/elastic/beats/filebeat/harvester/processor.(*timeoutProcessor).Next.func1(0xc82641e600)
        /go/src/github.com/elastic/beats/filebeat/harvester/processor/timeout.go:52 +0x4c
created by github.com/elastic/beats/filebeat/harvester/processor.(*timeoutProcessor).Next
        /go/src/github.com/elastic/beats/filebeat/harvester/processor/timeout.go:58 +0xa6

rax    0x0
rbx    0x7f8d6223e868
rcx    0xffffffffffffffff
rdx    0x6
rdi    0x229a
rsi    0x229b
rbp    0xa16208
rsp    0x7f8d61e81948
r8     0xa
r9     0x7f8d61e82700
r10    0x8
r11    0x206
r12    0x2c
r13    0xa10630
r14    0x0
r15    0x8
rip    0x7f8d61eb85d7
rflags 0x206
cs     0x33
fs     0x0
gs     0x0
2

Please share your configuration file, Filebeat version, OS, and any steps to reproduce. Thanks

3

Hi andrewkroh,
Im using
linux 64 bit
filbeat version- 1.1.2

This is my filebeat.yml file

filebeat:
  prospectors:
    -
      paths:
        - /log/DMSRDR/*_Request.txt
      document_type: dmsreq
      ignore_older: 72h
      backoff: 10s
      registry_file: /beats/dmsfilebeat
      multiline:
       pattern: '<\/.*:RetailDeliveryRecordBOD>'
       negate: true
       match: before
    -
      paths:
        - /log/RDR/*_Request.txt
      document_type: transreq
      ignore_older: 72h
      backoff: 10s
      registry_file: /beats/transreqfilebeat
      multiline:
       pattern: '<\/.*:Envelope>'
       negate: true
       match: before
       input_type: xml
    -
      paths:
        - /log/RDR/*_response.txt
      document_type: transresp
      ignore_older: 72h
      backoff: 10s
      registry_file: /beats/transresfilebeat
      multiline:
       pattern: '<\/.*:Envelope>'
       negate: true
       match: before
       input_type: xml
    -
      paths:
        - /log/RDR/*_response_fault.txt
      document_type: transfault
      ignore_older: 72h
      backoff: 10s
      registry_file: /beats/transfaultfilebeat
      multiline:
       pattern: '<\/.*:Envelope>'
       negate: true
       match: before
       input_type: xml
    -
      paths:
        - /log/PubRDR/*_Request.txt
      document_type: publishreq
      ignore_older: 72h
      backoff: 10s
      registry_file: /beats/.pubfilebeat
      multiline:
       pattern: '<\/.*:RetailDeliveryRecordBOD>'
       negate: true
       match: before
    -
      paths:
        - /log/ResponseRDR/*_Request.txt
      document_type: respreq
      ignore_older: 72h
      backoff: 10s
      registry_file: /beats/resrdrfilebeat
      multiline:
       pattern: '<\/.*:RetailDeliveryRecordBOD>'
       negate: true
       match: before
output: 
  logstash:     
     hosts: ["xx.xx.xx.xx:10724"]
console:
    pretty: true
4

Probably not going to solve the issue, but please not that registry_file can only be configured on the top level and not per prospector. There is only on registry file.

Are there some more details in the stack trace you get. It would be nice to see the log lines which were written before to figure out which log files causes it.

I assume the content of your log files is XML? Can you turn on debug mode by using -e -d "*" flag? When does filebeat crash? Directly when you start it or after some time?