How to kill filebeat (docker) process?

Elastic Stack Beats
,
#1

Hello, how can I kill filebeat process that was started on docker? Linux situation by "top" command:

image
image791×85 4.92 KB

I have restarted docker daemon, and it don't want to start - probably because of the filebeat, last log from docker service is:
Feb 05 11:30:30 server.address.com dockerd[86573]: time="2021-02-05T11:30:30.700507408Z" level=info msg="Loading containers: start.

Docker commands are unresponsive, restarting docker service is getting me the same situation, kill -9 filebeat-process-id/kill filebeat-process-id is not working. Do you have any ideas besides restarting of the server?

Last log that I have from filebeat container is:
2021-02-02T12:35:14.380Z ERROR pipeline/output.go:121 Failed to publish events: 400 Bad Request: {"error":{"root_cause":[{"type":"remote_transport_exception","reason":"[elastic-ingest-1][ip-address:9300][indices:data/write/bulk]"}],"type":"illegal_argument_exception","reason":"no write index is defined for alias [alias-name]. The write index may be explicitly disabled using is_write_index=false or the alias points to multiple indices without one being designated as a write index"},"status":400}

#2

Hi!

How about "killing" the container and starting it again? ie docker kill <fb-id>.

C.

#3

Unfortunately - docker kill <fb-id> is not responding, even docker ps is not responding. Docker service status is:

> Loaded: loaded (/usr/lib/systemd/system/docker.service; enabled; vendor preset: disabled)
>    Active: activating (start) since Fri 2021-02-05 11:30:29 UTC; 2 days ago
>      Docs: https://docs.docker.com
>  Main PID: 86573 (dockerd)
>     Tasks: 36
>    Memory: 107.5M
>    CGroup: /system.slice/docker.service
>            └─86573 /usr/bin/dockerd -H fd:// --containerd=/run/containerd/containerd.sock
#4

Can you even docker run sth? If your docker daemon is not responding you can try to restart it, otherwise your system is problematic in general and a restart may be the way to go regardless of Filebeat's involvement.

#5

Docker commands were also unresponsive. It seems like restart did the job.
Do you know why filebeat could behave in such way?

#6

I don't think that Filebeat as a container could make docker daemon crash/stall :thinking: directly. Maybe sth else went wrong on the system (could be related to filebeat's container) but cannot assume what.