Journalbeat didn't see messages

Elastic Stack Beats
1

Journalbeat doesn't send messages from journald into Logstash. In debug logs, only error I see:

Error while reading event: failed to get realtime timestamp: 99

According to https://github.com/elastic/beats/issues/11933, it means what in journald there are no new events. But if I launch journalctl I can clearly see them.

Any thoughts about the problem or how I can dig it?

Versions

journalbeat version 6.7.2 (amd64), libbeat 6.7.2
systemd 237
Ubuntu 18.04

2

After some tracing, I discover strange behavior.

Journalbeat discover all files in /var/log/journal/5df69cd93d052ec89c9ab8615518ceb8 and started to open them one by one.
But only 4096 bytes are mapped into memory, although fstat call returns right st_size for files.
Right after 4096 bytes from memory is cleaned.

Why Journalbeat can open a file, but not able mmap him into memory?

Trace

20788 openat(AT_FDCWD, "/var/log/journal/5df69cd93d052ec89c9ab8615518ceb8/system@97026089824948579ec654741475c6fd-0000000000000001-000586b78ced0f8b.journal", O_RDONLY|O_CLOEXEC) = 7</var/log/journal/5df69cd93d052ec89c9ab8615518ceb8/system@97026089824948579ec654741475c6fd-0000000000000001-000586b78ced0f8b.journal>

20788 fstat(7</var/log/journal/5df69cd93d052ec89c9ab8615518ceb8/system@97026089824948579ec654741475c6fd-0000000000000001-000586b78ced0f8b.journal>, {st_mode=S_IFREG|0640, st_size=100663296, ...}) = 0

20788 mmap(NULL, 4096, PROT_READ, MAP_SHARED, 7</var/log/journal/5df69cd93d052ec89c9ab8615518ceb8/system@97026089824948579ec654741475c6fd-0000000000000001-000586b78ced0f8b.journal>, 0) = 0x7f46f95c0000

20788 munmap(0x7f46f95c0000, 4096) = 0

20788 close(7</var/log/journal/5df69cd93d052ec89c9ab8615518ceb8/system@97026089824948579ec654741475c6fd-0000000000000001-000586b78ced0f8b.journal>) = 0