Filebeats ingesting filebeats logs

[newmember]

At first I added /var/log/filebeat/filebeat as an input in the "inputs.d/filebeat.yml" folder.

This created a circular logging issue; ie filebeat would write data to the filebeat log file then re-read that log event in the filebeat log and send it again and then the round robin thing happens.

I stopped filebeat
I removed the inputs.d/filebeat.yml
I renamed the filebeat cache registry folder "mv registry registry.old.0325"
I then restarted filebeat service

I still see filebeat reading in the filebeat logs.

What did I miss?

Thanks

[shaunak (Shaunak Kashyap)]

Hi,

A few questions to get started:

1. Which version of Filebeat are you using?

2. Could you post your complete Filebeat configuration file?

3. Could you grep for /var/log/filebeat in inputs.d/*, just to make sure it's not there?

4. Could you grep for /var/log/filebeat in the current Filebeat registry file and post the results here?

5. Also, could you post the output of lsof -c filebeat?

Thanks,

Shaunak

[newmember]

Thank you for the quick response. You are great.

As I was gathering things I had one more thought, which was likely the cause or causes. Its interesting that the config passed the test. "filebeat config test"

a.
"enabed" typo
b.
indent was a tab and not two spaces
c.
At first I renamed the yml file with an OLD extension to remove this input.

[yoyo@traumtech02 etc]# cat /etc/filebeat/inputs.d/filebeat_log.yml.OLD
- type: log

  # Change to true to enable this input configuration.
#  enabled: true
  enabed: false
  # Paths that should be crawled and fetched. Glob based paths.
  paths:
    - /var/log/filebeat/*