Here is some additional data that shows that when you make gc.enabled: false
and as soon as gc.log is created on the node, it starts filling up the index with these type of docs which looks like some kind of error (Look at the message field below)
{
"_index": "filebeat-7.7.1-2020.06.30-000001",
"_type": "_doc",
"_id": "xxx",
"_score": 1.0,
"_source": {
"agent": {
"hostname": "staging-elastic-data-node-1",
"id": "304ef102-540e-4e7d-b3a9-daab45bac2a9",
"type": "filebeat",
"ephemeral_id": "14c86b5a-9041-4b5c-9f93-b45fed100f54",
"version": "7.7.1"
},
"log": {
"file": {
"path": "/var/log/elasticsearch/gc.log"
},
"offset": 150030
},
"first_char": "[",
"fileset": {
"name": "server"
},
"message": "[2020-06-30T02:35:52.192+0000][5221][safepoint ] Safepoint \"Cleanup\", Time since last: 1000192268 ns, Reaching safepoint: 159192 ns, At safepoint: 3720 ns, Total: 162912 ns",
"error": {
"message": "Cannot invoke \\\"Object.getClass()\\\" because \\\"receiver\\\" is null"
},
"cloud": {
"availability_zone": "us-east-1b",
"image": {
"id": "ami-xxx"
},
"instance": {
"id": "i-xxx"
},
"provider": "aws",
"machine": {
"type": "t3a.medium"
},
"region": "us-east-1",
"account": {
"id": "560649687638"
}
},
"input": {
"type": "log"
},
"ecs": {
"version": "1.5.0"
},
"service": {
"type": "elasticsearch"
},
"host": {
"hostname": "staging-elastic-data-node-1",
"os": {
"kernel": "5.3.0-1023-aws",
"codename": "bionic",
"name": "Ubuntu",
"family": "debian",
"version": "18.04.4 LTS (Bionic Beaver)",
"platform": "ubuntu"
},
"containerized": false,
"ip": [
"10.0.xx.xx",
"fe80::cde:f4ff:fe13:a2e1"
],
"name": "staging-elastic-data-node-1",
"id": "xxx",
"mac": [
"xx:xx:xx:13:a2:e1"
],
"architecture": "x86_64"
},
"event": {
"timezone": "+00:00",
"created": "2020-06-30T02:35:53.025Z",
"module": "elasticsearch",
"dataset": "elasticsearch.server"
}
}
}