Filebeat6.0.0 Registry problem

Elastic Stack Beats
1

Hi,All
I hava a problem that the filebeat can't scan the document again.
firstly,there's 2 document path named /data/EDI/manifest/EKONEK/in/ .txt and /data/EDI/manifest/EKONEK/out/.txt ,when i start filebeat for the first time,it can run and transfer to logstash successfully and logstash transfer to elasticsearch successfully too.

secondly,i delete the index 'in' (/data/EDI/manifest/EKONEK/in/.txt ) and index 'out'(/data/EDI/manifest/EKONEK/out/.txt ) in elasticsearch,try to restart filebeat to transfer again,find that filebeat can't scan the document again.

thirdly,i delete the document {path}/data/registry and restart,the result is filebeat can scan the /data/EDI/manifest/EKONEK/out/.txt again but not /data/EDI/manifest/EKONEK/in/.txt .

And the document Registry still hava" /data/EDI/manifest/EKONEK/in/*.txt " 's message,what is the problem? pls help me .

2

Could you please share your configuration formatted using </>? Also, the output of ./filebeat -e -d "*" after deleting the registry file and the registry file after the input was read?

3

https://paste.fedoraproject.org/paste/-RZIbI1e-C0RgrySAgv5cg/deactivate/9UkIULkqCIwSMzIwty7NnHGgoDSns6lX9YNvKcS8PxCrKlOrSGyEneljMX2sK5VR
and https://paste.fedoraproject.org/paste/LIw6f~7ANseriO2SwogSTw/deactivate/0mywVwsHR7yPMcTOetxcSewHgs3HLbiRWQV65EqNxiHT1VXCzK0s8SWHn2IRqJCf
and
https://paste.fedoraproject.org/paste/3KagPM-Pc8jVOfqyMVsE~A/deactivate/OX0iErk3W9Eeo0o6hDGd5frqfgiVEWnhrrSslafo4xjTxCsHtf1O9iAr9fbOQDRk

The problem is I can't find the data of index "afsa2-ekonek-in-dev" in elasticsearch

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.