Int Overflow produces invalid Filebeat stats

Elastic Stack Beats
1

Hey,

we recently discovered some strange metrics coming from our Filebeats (8.19.19 running in k8s) because we have an alert to check for queue usage and alert if the queue gets to full.

Sometimes the value for "Queue filled percent" jumps to multiple millions. In between these peaks, the value behaves correctly and is in the [0,1] range.

2026-08-12-154558
2026-08-12-1545582664×816 198 KB

To debug this, we checked the values directly on the /stats endpoint on one of the filebeats and always after the queue got emptied, we see something like this:

% curl -s localhost:5066/stats | jq ".libbeat.pipeline.queue.filled" 
{
  "bytes": 9223372036850785612,
  "events": 9223372036854773835,
  "pct": 18446744073.705563
}

Because the values of bytes and events are pretty close to the max value of uint64 and it happens always after the queue got emptied, we assume that the code subtracts to much when calculating the current size of the queue, and then the uint flips over and becomes MAXINT.

Let me know when we can assist in any way to help fix this issue. Happy to convert this into an actual Github issue after "confirmation"

Best,

Felix

2

@fleaz thanks for reporting that!

Could you share your configuration (remember to redact any secrets/sensitive information)?

Are you using the disk queue?

3

Yes, we are using disk queue.

This is our current config:

name: '${FILEBEAT_INSTANCE_NAME}'
    output.elasticsearch:
      hosts: ['${ELASTICSEARCH_HOST:elasticsearch}:${ELASTICSEARCH_PORT:9200}']
      username: ${ELASTICSEARCH_USERNAME}
      password: ${ELASTICSEARCH_PASSWORD}
      protocol: "https"
      worker: 4
      bulk_max_size: 1024
      allow_older_versions: true
    output.elasticsearch.ssl.verification_mode: "none"
    output.elasticsearch.indices:
    - index: '%{[kube-apiserver.objectRef.namespace]}-audit-filebeat'
      when.and:
      - equals:
          kube-apiserver.apiVersion: audit.k8s.io/v1
      - not:
          equals:
            kube-apiserver.objectRef.namespace: '-'
    - index: '%{[kubernetes.namespace]}-%{[kubernetes.labels.es-index-bucket]}-filebeat'
      when.has_fields:
      - kubernetes.labels.es-index-bucket
    - index: '%{[kubernetes.namespace]}-filebeat'
      when.not:
        regexp:
          kubernetes.labels.es-index-bucket: ^.
    queue:
      disk:
        max_retry_interval: 30s
        max_size: 1GB
        path: ${path.data}/diskqueue
        read_ahead: 1024
        retry_interval: 1s
        segment_size: 100MB
        write_ahead: 2048

    setup.template.enabled: false
    setup.ilm.enabled: false

    monitoring.enabled: true
    http:
      enabled: true
      host: localhost
      port: 5066

    filebeat.autodiscover:
      providers:
      - type: kubernetes
        node: ${NODE_NAME}
        cleanup_timeout: 300s
        hints.enabled: true
        hints.default_config:
          type: container
          paths:
            - /var/log/pods/${data.kubernetes.namespace}_${data.kubernetes.pod.name}_*/${data.kubernetes.container.name}/*.log*
          exclude_files: ['\.gz$','\.tmp$']
          multiline.pattern: '^[[:space:]]'
          multiline.negate: false
          multiline.match: after
          exclude_lines: ["^\\s+[\\-`('.|_]"]  # drop asciiart lines
          fields:
            event.dataset: kubernetes
          fields_under_root: true

    processors:
      - add_fields:
          target: kubernetes
          fields:
            cluster: infra-dev
      - add_host_metadata:
          netinfo.enabled: false
      - add_cloud_metadata:
      - add_kubernetes_metadata:
          node: ${NODE_NAME}
          matchers:
          - logs_path:
              logs_path: "/var/log/containers/"
      - drop_fields:
          fields:
            [
              "agent.ephemeral_id",
              "agent.hostname",
              "agent.id",
              "agent.name",
              "ecs.version",
              "host.id",
              "host.name",
              "cloud.account.id",
              "cloud.instance.id",
              "cloud.machine.type",
              "cloud.project.id",
              "input.type",
              "log.offset",
              "kubernetes.labels.spilo-role",
              "kubernetes.node.hostname",
              "kubernetes.node.labels.beta_kubernetes_io/arch",
              "kubernetes.node.labels.beta_kubernetes_io/os",
              "kubernetes.node.labels.kubernetes_io/arch",
              "kubernetes.node.labels.kubernetes_io/os",
              "kubernetes.node.labels.kubernetes_io/hostname",
            ]
          ignore_missing: true
4

Thanks @fleaz ! I'll look into this.