Hi.
On one of my servers, after working for a few weeks, the following loglines are repeated, and nothing ends up on the elasticstack server:
{"log.level":"debug","@timestamp":"2023-05-08T13:53:56.309+0200","log.logger":"input","log.origin":{"file.name":"log/input.go","file.line":472},"message":"Check file for harvesting: /var/log/keycloak.log","service.name":"filebeat","input_id":"7bd729e6-316e-49d3-b441-efb0be279d63","ecs.version":"1.6.0"}
{"log.level":"debug","@timestamp":"2023-05-08T13:53:56.309+0200","log.logger":"input","log.origin":{"file.name":"log/input.go","file.line":570},"message":"Update existing file for harvesting: /var/log/keycloak.log, offset: 8470208","service.name":"filebeat","input_id":"7bd729e6-316e-49d3-b441-efb0be279d63","source":"/var/log/keycloak.log","state_id":"native::267-64768","finished":false,"os_id":"267-64768","old_source":"/var/log/keycloak.log","old_finished":false,"old_os_id":"267-64768","ecs.version":"1.6.0"}
{"log.level":"debug","@timestamp":"2023-05-08T13:53:56.309+0200","log.logger":"input","log.origin":{"file.name":"log/input.go","file.line":623},"message":"Harvester for file is still running: /var/log/keycloak.log","service.name":"filebeat","input_id":"7bd729e6-316e-49d3-b441-efb0be279d63","source":"/var/log/keycloak.log","state_id":"native::267-64768","finished":false,"os_id":"267-64768","old_source":"/var/log/keycloak.log","old_finished":false,"old_os_id":"267-64768","ecs.version":"1.6.0"}
I have restarted the whole server, so it does not seem to be a simple file lock issue.
Another server with a very similar setup still works. They were both set up with the same Fleet setup on the server.
Regards,
Anders