Filebeat's logs rotation malfunctioning

Elastic Stack Beats
1

Hi,

Below is my filebeat config:

filebeat.prospectors:
- input_type: log
  paths:
    - '/tmp/worker.log'
  encoding: utf-8
output.logstash:
  hosts: ["127.0.0.1:5044"]
  worker: 2
  loadbalance: true
  ssl.verification_mode: none
  ssl.certificate_authorities: ["/tmp/server.cert.pem"]
  ssl.certificate: "/tmp/server.cert.pem"
  ssl.key: "/tmp/server.key.pem"
logging.level: info
logging.metrics.enabled: true
logging.metrics.period: 30s
logging.to_files: true
logging.files:
  path: /tmp/filebeatlogs
  name: filebeat
  rotateeverybytes: 104857600 # = 100MB
  keepfiles: 10

Every time I restart I see two log files getting created.

-rw------- 1 root    root      4023 Aug  2 15:21 filebeat
-rw------- 1 root    root        57 Aug  2 15:13 filebeat.1
-rw------- 1 root    root      3514 Aug  2 15:13 filebeat.2
-rw------- 1 root    root        57 Aug  2 15:12 filebeat.3
-rw------- 1 root    root     48579 Aug  2 15:10 filebeat.4
-rw------- 1 root    root        57 Aug  2 10:10 filebeat.5

How to prevent this ? That small file always contains the following log.

2017-08-02T15:13:34+03:00 INFO Metrics logging every 30s

Is it because console is stopping for me to type sudo's password ?

2

filebeat rotates the logs on every restart or when the limit is reached. Having two files being generated is kind of weird. Looks like filebeat is restarted 'twice' when you trigger a restart...

You have any other content in the second log file?

Which OS/distribution are you using.

3

Hi,

I am really sorry for the late reply.

No, I don't have any other content in the second log file.

The following is my uname -a

Linux abhiroyg 4.4.0-87-generic #110-Ubuntu SMP Tue Jul 18 12:55:35 UTC 2017 x86_64 x86_64 x86_64 GNU/Linux

I think it is Ubuntu 16.04

I didn't test it further. But, from my current observation, it is happening whenever I had to enter password for sudo.

4

sounds weird. You using sudo systemctl restart filebeat? Does the same happen if you stop the service and run filebeat in foreground filebeat.sh ?

5

Oops. Sorry, no. I downloaded the tar.gz file and run the command sudo ./filebeat -c filebeat.yml -httpprof :7000 to start filebeat.

6

Which exact filebeat version are you using? Skimming the code, I suspect a potential race that might be triggered due to enabling -httpprof. This race might lead to files being rotated twice on startup.

Anyway, instead of rotation logs on every restart, we should also consider to change log rotation, to continue old files and only rotate once the configure size limit is reached.

7

Hi,

Thank you so much for taking that much pains! I am using 5.5.0 version.

Thanks!

8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.