Is it possible to suppress gc logs in filebeat elasticsearch module?

I tried editing the elasticsearch.yml file in modules.d folder but it does not seem to be working

I tried both commenting out gc section and tried gc.enabled: false but none of them seem to be working.

When this module is enabled, it always ingests gc logs

Here is some additional data that shows that when you make gc.enabled: false and as soon as gc.log is created on the node, it starts filling up the index with these type of docs which looks like some kind of error (Look at the message field below)

{
                "_index": "filebeat-7.7.1-2020.06.30-000001",
                "_type": "_doc",
                "_id": "xxx",
                "_score": 1.0,
                "_source": {
                    "agent": {
                        "hostname": "staging-elastic-data-node-1",
                        "id": "304ef102-540e-4e7d-b3a9-daab45bac2a9",
                        "type": "filebeat",
                        "ephemeral_id": "14c86b5a-9041-4b5c-9f93-b45fed100f54",
                        "version": "7.7.1"
                    },
                    "log": {
                        "file": {
                            "path": "/var/log/elasticsearch/gc.log"
                        },
                        "offset": 150030
                    },
                    "first_char": "[",
                    "fileset": {
                        "name": "server"
                    },
                    "message": "[2020-06-30T02:35:52.192+0000][5221][safepoint    ] Safepoint \"Cleanup\", Time since last: 1000192268 ns, Reaching safepoint: 159192 ns, At safepoint: 3720 ns, Total: 162912 ns",
                    "error": {
                        "message": "Cannot invoke \\\"Object.getClass()\\\" because \\\"receiver\\\" is null"
                    },
                    "cloud": {
                        "availability_zone": "us-east-1b",
                        "image": {
                            "id": "ami-xxx"
                        },
                        "instance": {
                            "id": "i-xxx"
                        },
                        "provider": "aws",
                        "machine": {
                            "type": "t3a.medium"
                        },
                        "region": "us-east-1",
                        "account": {
                            "id": "560649687638"
                        }
                    },
                    "input": {
                        "type": "log"
                    },
                    "ecs": {
                        "version": "1.5.0"
                    },
                    "service": {
                        "type": "elasticsearch"
                    },
                    "host": {
                        "hostname": "staging-elastic-data-node-1",
                        "os": {
                            "kernel": "5.3.0-1023-aws",
                            "codename": "bionic",
                            "name": "Ubuntu",
                            "family": "debian",
                            "version": "18.04.4 LTS (Bionic Beaver)",
                            "platform": "ubuntu"
                        },
                        "containerized": false,
                        "ip": [
                            "10.0.xx.xx",
                            "fe80::cde:f4ff:fe13:a2e1"
                        ],
                        "name": "staging-elastic-data-node-1",
                        "id": "xxx",
                        "mac": [
                            "xx:xx:xx:13:a2:e1"
                        ],
                        "architecture": "x86_64"
                    },
                    "event": {
                        "timezone": "+00:00",
                        "created": "2020-06-30T02:35:53.025Z",
                        "module": "elasticsearch",
                        "dataset": "elasticsearch.server"
                    }
                }
            }

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.