I faced with a filebeat high io consumption problem. Sometimes some of my filebeat daemons start to make abnormal number of io requests (thousands per seond). I checked it and found that filebeat make a checkpoint by checkpoint, but log still 0 bytes size. Then I saw source code and found that there is a two conditions to make a checkpoint: logInvalid flag is true and logfile reached some size. Log file is always zero size, and I decided that problem in logInvalid. logInvalid may set to true when occurs an error while read or write a logfile. I did a few experiments and found out that filebeat start a permanent checkpoint after sudden termination, in my case it happens quite often when hardware crashes or we force stop a k8s node.
After restart of filebeat it works normally
Is it a bug or normal behaviour?
Now I forced to watch on my io dashboard and restart filebeats few times a week, sounds boring