# Filebeat won't stop with SIGTERM if the --once flag is used,

**URL:** <https://discuss.elastic.co/t/filebeat-wont-stop-with-sigterm-if-the-once-flag-is-used/111009>\
**Category:** Beats\
**Created:** [December 11, 2017, 5:25am UTC](https://discuss.elastic.co/t/filebeat-wont-stop-with-sigterm-if-the-once-flag-is-used/111009 "2017-12-11T05:25:58Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Sheng\_Song](https://avatars.discourse-cdn.com/v4/letter/s/3ab097/32.png) [@Sheng\_Song](https://discuss.elastic.co/u/Sheng_Song)\
**Post date:** [December 11, 2017, 5:25am UTC](https://discuss.elastic.co/t/filebeat-wont-stop-with-sigterm-if-the-once-flag-is-used/111009/1 "2017-12-11T05:25:59Z")

</div>

Hi,

As described in title, my filebeat instance running with --once does not exit with SIGTERM. it does exit if without --once.  
Here is my simple yml:

> filebeat.prospectors:  
> - input\_type: log  
> paths:  
> - /xxx  
> close\_eof: true  
> output.logstash:  
> hosts: ["xxx:xxx"]  
> max\_retries : -1  
> filebeat.shutdown\_timeout: 5s

Here is the logging after sending SIGTERM:

> 2017-12-11T11:12:55+08:00 INFO Stopping filebeat  
> 2017-12-11T11:12:55+08:00 INFO Prospector outlet closed  
> 2017-12-11T11:12:55+08:00 INFO Prospector outlet closed  
> 2017-12-11T11:12:55+08:00 INFO Prospector outlet closed  
> 2017-12-11T11:12:55+08:00 INFO Prospector channel stopped  
> 2017-12-11T11:12:55+08:00 WARN send event  
> 2017-12-11T11:12:55+08:00 WARN send event  
> 2017-12-11T11:13:00+08:00 WARN send event  
> 2017-12-11T11:13:09+08:00 INFO Non-zero metrics in the last 30s: beat.memstats.gc\_next=-2263856 beat.memstats.memory\_alloc=14549368 beat.memstats.memory\_total=684261736 filebeat.harvester.closed=6 filebeat.harvester.open\_files=-6 filebeat.harvester.running=-6 output.events.acked=71689 output.logstash.events.acked=71689 output.logstash.publishEvents.call.count=35 output.logstash.read.bytes=396 output.logstash.write.bytes=9615104 output.write.bytes=9615104 publish.events=71696 publisher.events.count=69641 registrar.states.update=71696 registrar.writes=36  
> 2017-12-11T11:13:39+08:00 INFO Non-zero metrics in the last 30s: beat.memstats.memory\_alloc=7184 beat.memstats.memory\_total=7184

**is this expected behavior?**

---

<div class="post-metadata">

**Author:** ![kvch](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kvch/32/72058_2.png) [@kvch](https://discuss.elastic.co/u/kvch)\
**Post date:** [December 11, 2017, 11:39am UTC](https://discuss.elastic.co/t/filebeat-wont-stop-with-sigterm-if-the-once-flag-is-used/111009/2 "2017-12-11T11:39:50Z")

</div>

It is definitely not the expected behaviour. I've been able to reproduce it on master with enabling `log` prospector with default configuration.

Could you please open an issue? [https://github.com/elastic/beats/issues/new](https://github.com/elastic/beats/issues/new)

---

<div class="post-metadata">

**Author:** ![Sheng\_Song](https://avatars.discourse-cdn.com/v4/letter/s/3ab097/32.png) [@Sheng\_Song](https://discuss.elastic.co/u/Sheng_Song)\
**Post date:** [December 13, 2017, 8:22am UTC](https://discuss.elastic.co/t/filebeat-wont-stop-with-sigterm-if-the-once-flag-is-used/111009/3 "2017-12-13T08:22:35Z")

</div>

NP. [https://github.com/elastic/beats/issues/5869](https://github.com/elastic/beats/issues/5869)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 1, 2018, 5:26am UTC](https://discuss.elastic.co/t/filebeat-wont-stop-with-sigterm-if-the-once-flag-is-used/111009/4 "2018-01-01T05:26:07Z")

</div>

This topic was automatically closed after 21 days. New replies are no longer allowed.