Filebeat will not start CentOS 7

Elastic Stack Beats
1

So I am having a pretty big problem... Filebeat will not start as a service at all. It passes the config test so I know that my filebeat.yml is set up correctly. Here is weird part:

I am running this in a VM, and if I revert to a snapshot to the previous day then Filebeat works. Of course that really is no help because restarting a machine is pretty necessary.

As you can see above, logstash is running fine. Packetbeat is also running perfectly fine on this same box, it is just filebeat. I have tried with packetbeat running and not running with the same results.

Here is the log file from Filebeat

I don't know what else to try... the only output that I get when I run with '-d' for debug mode is this:

Exiting: Could not start registrar: Error loading state: Error decoding states: EOF

Like I said reboot doesn't do anything and the rest of this server is running fine.

2

Did you have Filebeat working properly at one point? Did you experience any kind of power failure or hard shutdown?

You should be able to remove the registry file at /var/lib/filebeat/registry and Filebeat should start.

It sounds like you might be experiencing this issue: https://github.com/elastic/beats/issues/3537 Can you please leave a comment on the Github issue saying you are also affected by it if you think it's the same issue.

3

Thank you very much! I deleted the registry file, and did the follow commands and now it works.

rm -r registry
systemctl reset-failed filebeat
systemctl start filebeat

I commented on the GitHub as well, thanks again.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.