How to kill filebeat (docker) process?

Hello, how can I kill filebeat process that was started on docker? Linux situation by "top" command:

I have restarted docker daemon, and it don't want to start - probably because of the filebeat, last log from docker service is:
Feb 05 11:30:30 server.address.com dockerd[86573]: time="2021-02-05T11:30:30.700507408Z" level=info msg="Loading containers: start.

Docker commands are unresponsive, restarting docker service is getting me the same situation, kill -9 filebeat-process-id/kill filebeat-process-id is not working. Do you have any ideas besides restarting of the server?

Last log that I have from filebeat container is:
2021-02-02T12:35:14.380Z ERROR pipeline/output.go:121 Failed to publish events: 400 Bad Request: {"error":{"root_cause":[{"type":"remote_transport_exception","reason":"[elastic-ingest-1][ip-address:9300][indices:data/write/bulk]"}],"type":"illegal_argument_exception","reason":"no write index is defined for alias [alias-name]. The write index may be explicitly disabled using is_write_index=false or the alias points to multiple indices without one being designated as a write index"},"status":400}

Hi!

How about "killing" the container and starting it again? ie docker kill <fb-id>.

C.

Unfortunately - docker kill <fb-id> is not responding, even docker ps is not responding. Docker service status is:

> Loaded: loaded (/usr/lib/systemd/system/docker.service; enabled; vendor preset: disabled)
>    Active: activating (start) since Fri 2021-02-05 11:30:29 UTC; 2 days ago
>      Docs: https://docs.docker.com
>  Main PID: 86573 (dockerd)
>     Tasks: 36
>    Memory: 107.5M
>    CGroup: /system.slice/docker.service
>            └─86573 /usr/bin/dockerd -H fd:// --containerd=/run/containerd/containerd.sock

Can you even docker run sth? If your docker daemon is not responding you can try to restart it, otherwise your system is problematic in general and a restart may be the way to go regardless of Filebeat's involvement.

Docker commands were also unresponsive. It seems like restart did the job.
Do you know why filebeat could behave in such way?

I don't think that Filebeat as a container could make docker daemon crash/stall :thinking: directly. Maybe sth else went wrong on the system (could be related to filebeat's container) but cannot assume what.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.