# Harvester for file is still running

**URL:** <https://discuss.elastic.co/t/harvester-for-file-is-still-running/332813>\
**Category:** Elastic Agent\
**Created:** [May 8, 2023, 12:09pm UTC](https://discuss.elastic.co/t/harvester-for-file-is-still-running/332813 "2023-05-08T12:09:13Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![AndersBolager](https://avatars.discourse-cdn.com/v4/letter/a/0ea827/32.png) [@AndersBolager](https://discuss.elastic.co/u/AndersBolager)\
**Post date:** [May 8, 2023, 12:09pm UTC](https://discuss.elastic.co/t/harvester-for-file-is-still-running/332813/1 "2023-05-08T12:09:13Z")

</div>

Hi.

On one of my servers, after working for a few weeks, the following loglines are repeated, and nothing ends up on the elasticstack server:

```auto
{"log.level":"debug","@timestamp":"2023-05-08T13:53:56.309+0200","log.logger":"input","log.origin":{"file.name":"log/input.go","file.line":472},"message":"Check file for harvesting: /var/log/keycloak.log","service.name":"filebeat","input_id":"7bd729e6-316e-49d3-b441-efb0be279d63","ecs.version":"1.6.0"}
{"log.level":"debug","@timestamp":"2023-05-08T13:53:56.309+0200","log.logger":"input","log.origin":{"file.name":"log/input.go","file.line":570},"message":"Update existing file for harvesting: /var/log/keycloak.log, offset: 8470208","service.name":"filebeat","input_id":"7bd729e6-316e-49d3-b441-efb0be279d63","source":"/var/log/keycloak.log","state_id":"native::267-64768","finished":false,"os_id":"267-64768","old_source":"/var/log/keycloak.log","old_finished":false,"old_os_id":"267-64768","ecs.version":"1.6.0"}
{"log.level":"debug","@timestamp":"2023-05-08T13:53:56.309+0200","log.logger":"input","log.origin":{"file.name":"log/input.go","file.line":623},"message":"Harvester for file is still running: /var/log/keycloak.log","service.name":"filebeat","input_id":"7bd729e6-316e-49d3-b441-efb0be279d63","source":"/var/log/keycloak.log","state_id":"native::267-64768","finished":false,"os_id":"267-64768","old_source":"/var/log/keycloak.log","old_finished":false,"old_os_id":"267-64768","ecs.version":"1.6.0"}

```

I have restarted the whole server, so it does not seem to be a simple file lock issue.  
Another server with a very similar setup still works. They were both set up with the same Fleet setup on the server.

Regards,  
Anders

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 5, 2023, 12:09pm UTC](https://discuss.elastic.co/t/harvester-for-file-is-still-running/332813/2 "2023-06-05T12:09:24Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.