Interpreting Filebeat INFO logs

I'm trying to understand the following Filebeat INFO log:

INFO Non-zero metrics in the last 30s: filebeat.harvester.closed=2 filebeat.harvester.open_files=-1 filebeat.harvester.running=-2 libbeat.publisher.published_events=545753 registrar.states.update=917504 registrar.writes=7

In particular, what do the following values mean? What are their differences? Which values are the important ones?

Events related:

Bytes related:


My guess is that: The events actually published, which is equal to the number of documents indexed successfully in Elasticsearch.

libbeat.publisher.published_events: If everything goes smooth, this should be equal to Otherwise, libbeat.publisher.published_events = + #not_acked_events. The number of events in the original log files, including both the events being published, and the events excluded. Hence, if you drop/exclude some events/lines in Filebeat prospector, then = libbeat.publisher.published_events + #excluded_lines.

I am still trying to understand and The size of my log files is 42GB. The size of the relevant lines in my log files is 37,508,554,927B (37.5GB). But after running, I get total 243121926 and total 56386818739, which do not match my data properties.

This topic was automatically closed after 21 days. New replies are no longer allowed.