# Metricbeat fail safe/over function on output

**URL:** https://discuss.elastic.co/t/metricbeat-fail-safe-over-function-on-output/142466
**Category:** Beats
**Tags:** metricbeat
**Created:** [August 1, 2018, 5:53am UTC](https://discuss.elastic.co/t/metricbeat-fail-safe-over-function-on-output/142466 "2018-08-01T05:53:26Z")
**Posts on this page:** 15
**Page:** 1

<div class="post-metadata">

### Author: ![jogoinar10](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jogoinar10/32/20068_2.png) [@jogoinar10](https://discuss.elastic.co/u/jogoinar10)
#### Post date: [August 1, 2018, 5:53am UTC](https://discuss.elastic.co/t/metricbeat-fail-safe-over-function-on-output/142466/1 "2018-08-01T05:53:26Z")

</div>

Is there a way in which i can save the data from metric beat even though the output destination is not available?  
Like for example elasticsearch host can't be reach, it will save first the data then continue once the connections is available again.

Or are the any third party application which I can store the pending data of metric beat?

TYIA!

---

<div class="post-metadata">

### Author: ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)
#### Post date: [August 1, 2018, 3:36pm UTC](https://discuss.elastic.co/t/metricbeat-fail-safe-over-function-on-output/142466/2 "2018-08-01T15:36:49Z")

</div>

There is a new disk spooling feature that you can use to write metrics to disk. When the output destination comes back online then the data stored in the disk backed queue will be forwarded to ES.

[https://www.elastic.co/guide/en/beats/metricbeat/6.3/configuring-internal-queue.html#configuration-internal-queue-spool](https://www.elastic.co/guide/en/beats/metricbeat/6.3/configuring-internal-queue.html#configuration-internal-queue-spool)

---

<div class="post-metadata">

### Author: ![jogoinar10](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jogoinar10/32/20068_2.png) [@jogoinar10](https://discuss.elastic.co/u/jogoinar10)
#### Post date: [August 2, 2018, 4:11am UTC](https://discuss.elastic.co/t/metricbeat-fail-safe-over-function-on-output/142466/3 "2018-08-02T04:11:17Z")

</div>

Hi @andrewkroh. I tried to implement the queue spool but i got problem. I couldn't start the metricbeat service after the implementation.  
Kindly check the config below.

```
 #========================== Modules configuration ============================

metricbeat.config.modules:
  path: ${path.config}/modules.d/*.yml
  reload.enabled: true
  reload.period: 10s

#==================== Elasticsearch template setting ==========================

setup.template.settings:
  index.number_of_shards: 1
  index.codec: best_compression
  #_source.enabled: false

queue.spool:
  file:
    path: "${path.data}/spool.dat"
    size: 300GiB
    page_size: 16KiB
  write:
    buffer_size: 10MiB
    flush.timeout: 5s
    flush.events: 1024

#-------------------------- Elasticsearch output ------------------------------
output.elasticsearch:
  # Array of hosts to connect to.
   hosts: ["192.168.200.254:9200"]
```

---

<div class="post-metadata">

### Author: ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)
#### Post date: [August 2, 2018, 4:23am UTC](https://discuss.elastic.co/t/metricbeat-fail-safe-over-function-on-output/142466/4 "2018-08-02T04:23:20Z")

</div>

> [@jogoinar10](#):
>
> I couldn't start the metricbeat service after the implementation.

What error is the log file?

What version of Metricbeat? This was introduced in 6.3.

---

<div class="post-metadata">

### Author: ![jogoinar10](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jogoinar10/32/20068_2.png) [@jogoinar10](https://discuss.elastic.co/u/jogoinar10)
#### Post date: [August 2, 2018, 5:10am UTC](https://discuss.elastic.co/t/metricbeat-fail-safe-over-function-on-output/142466/5 "2018-08-02T05:10:50Z")

</div>

I'm running on metricbeat 6.3.1

Here is the error from the log file:

```
 metricbeat stopped.
2018-08-02T12:09:17.067+0800 ERROR instance/beat.go:691 Exiting: error initializing publisher: file permissions must be more strict (required permissions: -rw-------, actual permissions: -rw-rw-rw-)
```

---

<div class="post-metadata">

### Author: ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)
#### Post date: [August 2, 2018, 5:23am UTC](https://discuss.elastic.co/t/metricbeat-fail-safe-over-function-on-output/142466/6 "2018-08-02T05:23:52Z")

</div>

Based on the error, you need to change the permissions on your config files.

Try `sudo chmod 0400 /etc/metricbeat/metricbeat.yml`

---

<div class="post-metadata">

### Author: ![jogoinar10](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jogoinar10/32/20068_2.png) [@jogoinar10](https://discuss.elastic.co/u/jogoinar10)
#### Post date: [August 2, 2018, 5:55am UTC](https://discuss.elastic.co/t/metricbeat-fail-safe-over-function-on-output/142466/7 "2018-08-02T05:55:02Z")

</div>

My metricbeat is on Windows 10 machine.

I tried to chmod the yml in unix but still an error occur

---

<div class="post-metadata">

### Author: ![jogoinar10](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jogoinar10/32/20068_2.png) [@jogoinar10](https://discuss.elastic.co/u/jogoinar10)
#### Post date: [August 2, 2018, 6:44am UTC](https://discuss.elastic.co/t/metricbeat-fail-safe-over-function-on-output/142466/8 "2018-08-02T06:44:07Z")

</div>

Just to confirm,

it the config is valid?

```
queue.spool:
  file:
    path: "${path.data}/spool.dat"
    size: 300GiB
    page_size: 16KiB
  write:
    buffer_size: 10MiB
    flush.timeout: 5s
    flush.events: 1024
```

---

<div class="post-metadata">

### Author: ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)
#### Post date: [August 2, 2018, 5:59pm UTC](https://discuss.elastic.co/t/metricbeat-fail-safe-over-function-on-output/142466/9 "2018-08-02T17:59:19Z")

</div>

> [@jogoinar10](#):
>
> it the config is valid?

It works on my machine using 6.3.1, but I'm not on Windows. After learning that you are using Windows I am surprised to see that file permission error because AFAIK windows does not use POSIX permissions like show in the error, but has a DACL.

Can you try a workaround by adding `permissions: 0777`.

```auto
queue.spool:
  file:
    path: "${path.data}/spool.dat"
    size: 300GiB
    page_size: 16KiB
    permissions: 0777
  write:
    buffer_size: 10MiB
    flush.timeout: 5s
    flush.events: 1024

```

---

<div class="post-metadata">

### Author: ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)
#### Post date: [August 2, 2018, 6:16pm UTC](https://discuss.elastic.co/t/metricbeat-fail-safe-over-function-on-output/142466/10 "2018-08-02T18:16:22Z")

</div>

I opened an issue.

> <https://github.com/elastic/beats/issues/7849>

---

<div class="post-metadata">

### Author: ![jogoinar10](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jogoinar10/32/20068_2.png) [@jogoinar10](https://discuss.elastic.co/u/jogoinar10)
#### Post date: [August 3, 2018, 3:53am UTC](https://discuss.elastic.co/t/metricbeat-fail-safe-over-function-on-output/142466/11 "2018-08-03T03:53:03Z")

</div>

Hi @andrewkroh, i tried to set permissions, but still I cannot start the service of metricbeat.

---

<div class="post-metadata">

### Author: ![jogoinar10](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jogoinar10/32/20068_2.png) [@jogoinar10](https://discuss.elastic.co/u/jogoinar10)
#### Post date: [August 3, 2018, 3:58am UTC](https://discuss.elastic.co/t/metricbeat-fail-safe-over-function-on-output/142466/12 "2018-08-03T03:58:00Z")

</div>

got new error message.

```
metricbeat stopped.
2018-08-03T11:53:47.570+0800 ERROR instance/beat.go:691 Exiting: error initializing publisher: spool queue: failed to open file at path 'C:\ProgramData\metricbeat/spool.dat': file C:\ProgramData\metricbeat/spool.dat can not be locked right now
```

---

<div class="post-metadata">

### Author: ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)
#### Post date: [August 3, 2018, 2:15pm UTC](https://discuss.elastic.co/t/metricbeat-fail-safe-over-function-on-output/142466/13 "2018-08-03T14:15:39Z")

</div>

Sorry, it looks like you worked around the problem only to hit another one. The spooling to disk feature is still marked as beta. Can you please open a new issue on Github for the last error you hit and we'll get it fixed. I'm quite sure it's some kind of bug specific to Windows.

---

<div class="post-metadata">

### Author: ![jogoinar10](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jogoinar10/32/20068_2.png) [@jogoinar10](https://discuss.elastic.co/u/jogoinar10)
#### Post date: [August 6, 2018, 5:23am UTC](https://discuss.elastic.co/t/metricbeat-fail-safe-over-function-on-output/142466/14 "2018-08-06T05:23:31Z")

</div>

Hi @andrewkroh, thanks. i already open an issue in github.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 3, 2018, 5:23am UTC](https://discuss.elastic.co/t/metricbeat-fail-safe-over-function-on-output/142466/15 "2018-09-03T05:23:33Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
