# Is Beats central management requires Restart of agent when we have update in central management configuration

**URL:** <https://discuss.elastic.co/t/is-beats-central-management-requires-restart-of-agent-when-we-have-update-in-central-management-configuration/194439>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [August 8, 2019, 1:32pm UTC](https://discuss.elastic.co/t/is-beats-central-management-requires-restart-of-agent-when-we-have-update-in-central-management-configuration/194439 "2019-08-08T13:32:24Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![kabali12345](https://avatars.discourse-cdn.com/v4/letter/k/6a8cbe/32.png) [@kabali12345](https://discuss.elastic.co/u/kabali12345)\
**Post date:** [August 8, 2019, 1:32pm UTC](https://discuss.elastic.co/t/is-beats-central-management-requires-restart-of-agent-when-we-have-update-in-central-management-configuration/194439/1 "2019-08-08T13:32:24Z")

</div>

Hi Team,

I am trying to setup beats central management, at the beginning of enrollment I have configured /tmp/test1.txt file for monitoring, then started beats agent, I am able to see the events in logstash.

After that, I have added one more file /tmp/test2.yml input under the configuration section, but this time I am not able to see the logs of /tmp/test2.yml until I restarted the beats agent again.

**Is it expected behavior of central management of beats?**

Thanks

---

<div class="post-metadata">

**Author:** ![Michal\_Pristas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/michal_pristas/32/46639_2.png) [@Michal\_Pristas](https://discuss.elastic.co/u/Michal_Pristas)\
**Post date:** [August 8, 2019, 2:01pm UTC](https://discuss.elastic.co/t/is-beats-central-management-requires-restart-of-agent-when-we-have-update-in-central-management-configuration/194439/2 "2019-08-08T14:01:48Z")

</div>

do you modify configuration file directly?

---

<div class="post-metadata">

**Author:** ![kabali12345](https://avatars.discourse-cdn.com/v4/letter/k/6a8cbe/32.png) [@kabali12345](https://discuss.elastic.co/u/kabali12345)\
**Post date:** [August 8, 2019, 4:12pm UTC](https://discuss.elastic.co/t/is-beats-central-management-requires-restart-of-agent-when-we-have-update-in-central-management-configuration/194439/3 "2019-08-08T16:12:17Z")

</div>

No, I am not.  
I am trying to update beats configuration directly from **central management** only.

Thanks

---

<div class="post-metadata">

**Author:** ![Michal\_Pristas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/michal_pristas/32/46639_2.png) [@Michal\_Pristas](https://discuss.elastic.co/u/Michal_Pristas)\
**Post date:** [August 9, 2019, 9:56am UTC](https://discuss.elastic.co/t/is-beats-central-management-requires-restart-of-agent-when-we-have-update-in-central-management-configuration/194439/4 "2019-08-09T09:56:07Z")

</div>

in central management you need to configure `filebeat.inputs`  
also central management should log that it received configuration or something similar. can you please check/share so we can see if there's something weird happening?  
in logs you should see something like this  
`2019-07-31T09:01:00.910Z INFO [centralmgmt] manager.go:211 Applying settings for filebeat.inputs`

---

<div class="post-metadata">

**Author:** ![kabali12345](https://avatars.discourse-cdn.com/v4/letter/k/6a8cbe/32.png) [@kabali12345](https://discuss.elastic.co/u/kabali12345)\
**Post date:** [August 9, 2019, 1:04pm UTC](https://discuss.elastic.co/t/is-beats-central-management-requires-restart-of-agent-when-we-have-update-in-central-management-configuration/194439/5 "2019-08-09T13:04:26Z")

</div>

In central management, first I have configured filebeat.input to fetch the logs which match the following pattern **/root/filebt/\*.txt**

```
2019-08-09 17:59:13 elasticsearch_masternode filebeat: info 2019-08-09T17:59:13.410+0530#011INFO#011[centralmgmt]#011management/manager.go:239#011New configurations retrieved
2019-08-09 17:59:13 elasticsearch_masternode filebeat: info 2019-08-09T17:59:13.410+0530#011INFO#011[centralmgmt]#011management/manager.go:328#011Updating state to 'IN_PROGRESS'
2019-08-09 17:59:13 elasticsearch_masternode filebeat: info 2019-08-09T17:59:13.410+0530#011INFO#011[centralmgmt]#011management/manager.go:279#011Applying settings for filebeat.inputs
2019-08-09 17:59:13 elasticsearch_masternode filebeat: info 2019-08-09T17:59:13.410+0530#011INFO#011log/harvester.go:274#011Reader was closed: /root/fb/test.txt. Closing.
**2019-08-09 17:59:13 elasticsearch_masternode filebeat: info 2019-08-09T17:59:13.410+0530#011INFO#011log/input.go:148#011Configured paths: [/root/filebt/*.txt]**
2019-08-09 17:59:13 elasticsearch_masternode filebeat: info 2019-08-09T17:59:13.410+0530#011INFO#011[centralmgmt]#011management/manager.go:279#011Applying settings for output
2019-08-09 17:59:13 elasticsearch_masternode filebeat: info 2019-08-09T17:59:13.411+0530#011INFO#011[centralmgmt]#011management/manager.go:279#011Applying settings for filebeat.modules
**2019-08-09 17:59:13 elasticsearch_masternode filebeat: info 2019-08-09T17:59:13.411+0530#011INFO#011[centralmgmt]#011management/manager.go:328#011Updating state to 'RUNNING'**
2019-08-09 17:59:13 elasticsearch_masternode filebeat: info 2019-08-09T17:59:13.411+0530#011INFO#011[centralmgmt]#011management/manager.go:191#011Storing new state
2019-08-09 17:59:13 elasticsearch_masternode filebeat: info 2019-08-09T17:59:13.411+0530#011INFO#011log/harvester.go:253#011Harvester started for file: /root/filebt/test.txt
2019-08-09 17:59:14 elasticsearch_masternode filebeat: info 2019-08-09T17:59:14.411+0530#011INFO#011pipeline/output.go:95#011Connecting to backoff(async(tcp://192.168.1.59:5050))
2019-08-09 17:59:14 elasticsearch_masternode filebeat: info 2019-08-09T17:59:14.412+0530#011INFO#011pipeline/output.go:105#011Connection to backoff(async(tcp://192.168.1.59:5050)) established
2019-08-09 17:59:21 elasticsearch_masternode crmd[1870]: notice notice: State transition S_IDLE -> S_POLICY_ENGINE
2019-08-09 17:59:21 elasticsearch_masternode crmd[1870]: notice notice: Transition 3226 (Complete=0, Pending=0, Fired=0, Skipped=0, Incomplete=0, Source=/var/lib/pacemaker/pengine/pe-input-46.bz2): Complete

```

After that, I have added one more filebeat.input which actually fetches **.csv (/root/filebt/\*.csv)files** from the same directory **/root/filebt** and then I saved this configuration and Observed the logs of filebeat.  
This time filebeats failed to fetch .csv logs from /root/filebt directory.  
Here are the logs of filebeat.

```
2019-08-09 18:01:14 elasticsearch_masternode filebeat: info 2019-08-09T18:01:14.588+0530#011INFO#011[centralmgmt]#011management/manager.go:239#011New configurations retrieved
2019-08-09 18:01:14 elasticsearch_masternode filebeat: info 2019-08-09T18:01:14.588+0530#011INFO#011[centralmgmt]#011management/manager.go:328#011Updating state to 'IN_PROGRESS'
2019-08-09 18:01:14 elasticsearch_masternode filebeat: info 2019-08-09T18:01:14.588+0530#011INFO#011[centralmgmt]#011management/manager.go:279#011Applying settings for filebeat.inputs
2019-08-09 18:01:14 elasticsearch_masternode filebeat: info 2019-08-09T18:01:14.589+0530#011INFO#011input/input.go:149#011input ticker stopped
**2019-08-09 18:01:14 elasticsearch_masternode filebeat: info 2019-08-09T18:01:14.589+0530#011INFO#011log/harvester.go:274#011Reader was closed: /root/filebt/test.txt. Closing.**
**2019-08-09 18:01:14 elasticsearch_masternode filebeat: info 2019-08-09T18:01:14.589+0530#011ERROR#011[centralmgmt]#011cfgfile/list.go:96#011Error creating runner from config: Can only start an input when all related states are finished: {Id:403511674-64768 Finished:false Fileinfo:0xc000179ee0 Source:/root/filebt/test.txt Offset:57 Timestamp:2019-08-09 17:59:14.443961705 +0530 IST m=+96229.703596804 TTL:-1ns Type:log Meta:map[] FileStateOS:403511674-64768}**
**2019-08-09 18:01:14 elasticsearch_masternode filebeat: info 2019-08-09T18:01:14.589+0530#011ERROR#011[centralmgmt]#011management/manager.go:315#0111 error: Error creating runner from config: Can only start an input when all related states are finished: {Id:403511674-64768 Finished:false Fileinfo:0xc000179ee0 Source:/root/filebt/test.txt Offset:57 Timestamp:2019-08-09 17:59:14.443961705 +0530 IST m=+96229.703596804 TTL:-1ns Type:log Meta:map[] FileStateOS:403511674-64768}**
2019-08-09 18:01:14 elasticsearch_masternode filebeat: info 2019-08-09T18:01:14.589+0530#011INFO#011[centralmgmt]#011management/manager.go:279#011Applying settings for filebeat.modules
2019-08-09 18:01:14 elasticsearch_masternode filebeat: info 2019-08-09T18:01:14.589+0530#011INFO#011[centralmgmt]#011management/manager.go:328#011Updating state to 'FAILED'
2019-08-09 18:01:14 elasticsearch_masternode filebeat: info 2019-08-09T18:01:14.590+0530#011INFO#011[centralmgmt]#011management/manager.go:191#011Storing new state
2019-08-09 18:01:24 elasticsearch_masternode filebeat: info 

```

**I am hoping that I am getting this error because I am pointing the same directory twice in filebeat.input section.**

And If I specify a different directory like **/root/filebt1/\*.log** instead of **/root/filebt/\*.csv**  
Beats agent perfectly able to receive the configuration from Kibana and sending the logs to output section.  
Here are the logs of beats agent for **/root/filebt1/\*.log**

```
2019-08-09 18:26:29 elasticsearch_masternode filebeat: info 2019-08-09T18:26:29.084+0530#011INFO#011[centralmgmt]#011management/manager.go:239#011New configurations retrieved
2019-08-09 18:26:29 elasticsearch_masternode filebeat: info 2019-08-09T18:26:29.084+0530#011INFO#011[centralmgmt]#011management/manager.go:328#011Updating state to 'IN_PROGRESS'
**2019-08-09 18:26:29 elasticsearch_masternode filebeat: info 2019-08-09T18:26:29.084+0530#011INFO#011log/input.go:148#011Configured paths: [/root/filebt/*.txt /root/filebt1/*.txt /]**
2019-08-09 18:26:29 elasticsearch_masternode filebeat: info 2019-08-09T18:26:29.084+0530#011INFO#011[centralmgmt]#011management/manager.go:279#011Applying settings for filebeat.modules
**2019-08-09 18:26:29 elasticsearch_masternode filebeat: info 2019-08-09T18:26:29.084+0530#011INFO#011[centralmgmt]#011management/manager.go:328#011Updating state to 'RUNNING'**
2019-08-09 18:26:29 elasticsearch_masternode filebeat: info 2019-08-09T18:26:29.085+0530#011INFO#011log/harvester.go:253#011Harvester started for file: /root/filebt1/test.txt

```

Am I understand it correctly?

Thank you

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 6, 2019, 1:04pm UTC](https://discuss.elastic.co/t/is-beats-central-management-requires-restart-of-agent-when-we-have-update-in-central-management-configuration/194439/6 "2019-09-06T13:04:36Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.