# Metricbeat services restarted automatically

**URL:** <https://discuss.elastic.co/t/metricbeat-services-restarted-automatically/326822>\
**Category:** Beats\
**Tags:** metricbeat\
**Created:** [March 2, 2023, 5:53am UTC](https://discuss.elastic.co/t/metricbeat-services-restarted-automatically/326822 "2023-03-02T05:53:33Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![ArpitChoudhary](https://avatars.discourse-cdn.com/v4/letter/a/439d5e/32.png) [@ArpitChoudhary](https://discuss.elastic.co/u/ArpitChoudhary)\
**Post date:** [March 2, 2023, 5:53am UTC](https://discuss.elastic.co/t/metricbeat-services-restarted-automatically/326822/1 "2023-03-02T05:53:33Z")

</div>

Hello Guys.  
Facing an issue , Metricbeat service is recursively getting restarting.  
Please find below status/log of service.

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/c/3/c3950b43abf826279b3145ed6b27c440a8f6857f.png)

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [March 2, 2023, 9:57am UTC](https://discuss.elastic.co/t/metricbeat-services-restarted-automatically/326822/2 "2023-03-02T09:57:04Z")

</div>

Please don't post pictures of text, logs or code. They are difficult to read, impossible to search and replicate (if it's code), and some people may not be even able to see them 🙂

---

<div class="post-metadata">

**Author:** ![ArpitChoudhary](https://avatars.discourse-cdn.com/v4/letter/a/439d5e/32.png) [@ArpitChoudhary](https://discuss.elastic.co/u/ArpitChoudhary)\
**Post date:** [March 3, 2023, 5:15am UTC](https://discuss.elastic.co/t/metricbeat-services-restarted-automatically/326822/3 "2023-03-03T05:15:46Z")

</div>

Sorry my bad .  
Please view the status of Metricbeat service.

metricbeat.service - Metricbeat is a lightweight shipper for metrics.  
Loaded: loaded (/lib/systemd/system/metricbeat.service; enabled; vendor preset: enabled)  
Active: active (running) since Fri 2023-03-03 10:44:12 IST; 2s ago  
Docs: [Metricbeat: Lightweight Shipper for Metrics | Elastic](https://www.elastic.co/beats/metricbeat)  
Main PID: 348014 (metricbeat)  
Tasks: 12 (limit: 19066)  
Memory: 37.9M  
CGroup: /system.slice/metricbeat.service  
└─348014 /usr/share/metricbeat/bin/metricbeat --environment systemd -c /etc/metricbeat/metricbeat.yml --path.home /usr/share/metricbeat --path.config /etc\>

Mar 03 10:44:16 ekb12 metricbeat[348014]: {"log.level":"info","@timestamp":"2023-03-03T10:44:16.284+0530","log.origin":{"file.name":"instance/beat.go","file.line":491}\>  
Mar 03 10:44:16 ekb12 metricbeat[348014]: {"log.level":"error","@timestamp":"2023-03-03T10:44:16.284+0530","log.origin":{"file.name":"instance/beat.go","file.line":107\>  
Mar 03 10:44:16 ekb12 metricbeat[348014]: Exiting: 1 error: error unpack raw module config using UnpackConfig: string value is not set accessing '0.client\_id' (source:\>  
Mar 03 10:44:16 ekb12 systemd[1]: metricbeat.service: Main process exited, code=exited, status=1/FAILURE  
Mar 03 10:44:16 ekb12 systemd[1]: metricbeat.service: Failed with result 'exit-code'.  
Mar 03 10:44:16 ekb12 systemd[1]: metricbeat.service: Scheduled restart job, restart counter is at 23137.  
Mar 03 10:44:16 ekb12 systemd[1]: Stopped Metricbeat is a lightweight shipper for metrics..  
Mar 03 10:44:16 ekb12 systemd[1]: Started Metricbeat is a lightweight shipper for metrics..  
Mar 03 10:44:16 ekb12 metricbeat[348032]: {"log.level":"info","@timestamp":"2023-03-03T10:44:16.751+0530","log.origin":{"file.name":"instance/beat.go","file.line":724}\>  
Mar 03 10:44:16 ekb12 metricbeat[348032]: {"log.level":"info","@timestamp":"2023-03-03T10:44:16.751+0530","log.origin":{"file.name":"instance/beat.go","file.line":732}\>  
Mar 03 10:44:19 ekb12 metricbeat[348032]: {"log.level":"warn","@timestamp":"2023-03-03T10:44:19.756+0530","log.logger":"add\_cloud\_metadata","log.origin":{"file.name":"\>  
Mar 03 10:44:19 ekb12 metricbeat[348032]: {"log.level":"info","@timestamp":"2023-03-03T10:44:19.758+0530","log.logger":"seccomp","log.origin":{"file.name":"seccomp/sec\>  
Mar 03 10:44:19 ekb12 metricbeat[348032]: {"log.level":"info","@timestamp":"2023-03-03T10:44:19.758+0530","log.logger":"beat","log.origin":{"file.name":"instance/beat.\>  
Mar 03 10:44:19 ekb12 metricbeat[348032]: {"log.level":"info","@timestamp":"2023-03-03T10:44:19.758+0530","log.logger":"beat","log.origin":{"file.name":"instance/beat.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [March 5, 2023, 10:43pm UTC](https://discuss.elastic.co/t/metricbeat-services-restarted-automatically/326822/4 "2023-03-05T22:43:20Z")

</div>

What does your `metricbeat.log` show? What does your config look like?

---

<div class="post-metadata">

**Author:** ![ArpitChoudhary](https://avatars.discourse-cdn.com/v4/letter/a/439d5e/32.png) [@ArpitChoudhary](https://discuss.elastic.co/u/ArpitChoudhary)\
**Post date:** [March 6, 2023, 6:53am UTC](https://discuss.elastic.co/t/metricbeat-services-restarted-automatically/326822/5 "2023-03-06T06:53:36Z")

</div>

i am unable to find the log file in /etc/metricbeat and even in /var/log/metricbeat.  
I run "journalctl -u metricbeat.service" and got this output.

root@ekb02:/nfs/ekb\_bkp/ekb\_scripts# journalctl -u metricbeat.service  
-- Logs begin at Mon 2023-03-06 09:36:21 IST, end at Mon 2023-03-06 12:18:52 IST. --  
Mar 06 09:36:24 ekb02 metricbeat[1329274]: {"log.level":"warn","@timestamp":"2023-03-06T09:36:24.747+0530","log.logger":"add\_cloud\_metadata","log.origin":{"file.name":\>  
Mar 06 09:36:24 ekb02 metricbeat[1329274]: {"log.level":"info","@timestamp":"2023-03-06T09:36:24.775+0530","log.logger":"seccomp","log.origin":{"file.name":"seccomp/se\>  
Mar 06 09:36:24 ekb02 metricbeat[1329274]: {"log.level":"info","@timestamp":"2023-03-06T09:36:24.775+0530","log.logger":"beat","log.origin":{"file.name":"instance/beat\>  
Mar 06 09:36:24 ekb02 metricbeat[1329274]: {"log.level":"info","@timestamp":"2023-03-06T09:36:24.775+0530","log.logger":"beat","log.origin":{"file.name":"instance/beat\>  
Mar 06 09:36:24 ekb02 metricbeat[1329274]: {"log.level":"info","@timestamp":"2023-03-06T09:36:24.775+0530","log.logger":"beat","log.origin":{"file.name":"instance/beat\>  
Mar 06 09:36:24 ekb02 metricbeat[1329274]: {"log.level":"info","@timestamp":"2023-03-06T09:36:24.777+0530","log.logger":"beat","log.origin":{"file.name":"instance/beat\>  
Mar 06 09:36:24 ekb02 metricbeat[1329274]: {"log.level":"info","@timestamp":"2023-03-06T09:36:24.778+0530","log.logger":"beat","log.origin":{"file.name":"instance/beat\>  
Mar 06 09:36:24 ekb02 metricbeat[1329274]: {"log.level":"info","@timestamp":"2023-03-06T09:36:24.778+0530","log.origin":{"file.name":"instance/beat.go","file.line":296\>  
Mar 06 09:36:24 ekb02 metricbeat[1329274]: {"log.level":"warn","@timestamp":"2023-03-06T09:36:24.796+0530","log.logger":"cfgwarn","log.origin":{"file.name":"tlscommon/\>  
Mar 06 09:36:24 ekb02 metricbeat[1329274]: {"log.level":"info","@timestamp":"2023-03-06T09:36:24.796+0530","log.logger":"esclientleg","log.origin":{"file.name":"eslegc\>  
Mar 06 09:36:24 ekb02 metricbeat[1329274]: {"log.level":"warn","@timestamp":"2023-03-06T09:36:24.797+0530","log.logger":"tls","log.origin":{"file.name":"tlscommon/tls\_\>  
Mar 06 09:36:24 ekb02 metricbeat[1329274]: {"log.level":"info","@timestamp":"2023-03-06T09:36:24.797+0530","log.logger":"esclientleg","log.origin":{"file.name":"eslegc\>  
Mar 06 09:36:24 ekb02 metricbeat[1329274]: {"log.level":"warn","@timestamp":"2023-03-06T09:36:24.797+0530","log.logger":"tls","log.origin":{"file.name":"tlscommon/tls\_\>  
Mar 06 09:36:24 ekb02 metricbeat[1329274]: {"log.level":"info","@timestamp":"2023-03-06T09:36:24.797+0530","log.logger":"esclientleg","log.origin":{"file.name":"eslegc\>  
Mar 06 09:36:24 ekb02 metricbeat[1329274]: {"log.level":"warn","@timestamp":"2023-03-06T09:36:24.797+0530","log.logger":"tls","log.origin":{"file.name":"tlscommon/tls\_\>  
Mar 06 09:36:24 ekb02 metricbeat[1329274]: {"log.level":"info","@timestamp":"2023-03-06T09:36:24.797+0530","log.logger":"esclientleg","log.origin":{"file.name":"eslegc\>  
Mar 06 09:36:24 ekb02 metricbeat[1329274]: {"log.level":"warn","@timestamp":"2023-03-06T09:36:24.797+0530","log.logger":"tls","log.origin":{"file.name":"tlscommon/tls\_\>  
Mar 06 09:36:24 ekb02 metricbeat[1329274]: {"log.level":"info","@timestamp":"2023-03-06T09:36:24.797+0530","log.logger":"esclientleg","log.origin":{"file.name":"eslegc\>  
Mar 06 09:36:24 ekb02 metricbeat[1329274]: {"log.level":"warn","@timestamp":"2023-03-06T09:36:24.797+0530","log.logger":"tls","log.origin":{"file.name":"tlscommon/tls\_\>  
Mar 06 09:36:24 ekb02 metricbeat[1329274]: {"log.level":"info","@timestamp":"2023-03-06T09:36:24.797+0530","log.logger":"esclientleg","log.origin":{"file.name":"eslegc\>  
Mar 06 09:36:24 ekb02 metricbeat[1329274]: {"log.level":"warn","@timestamp":"2023-03-06T09:36:24.797+0530","log.logger":"tls","log.origin":{"file.name":"tlscommon/tls\_\>  
Mar 06 09:36:24 ekb02 metricbeat[1329274]: {"log.level":"info","@timestamp":"2023-03-06T09:36:24.797+0530","log.logger":"esclientleg","log.origin":{"file.name":"eslegc\>  
Mar 06 09:36:24 ekb02 metricbeat[1329274]: {"log.level":"warn","@timestamp":"2023-03-06T09:36:24.797+0530","log.logger":"tls","log.origin":{"file.name":"tlscommon/tls\_\>  
Mar 06 09:36:24 ekb02 metricbeat[1329274]: {"log.level":"info","@timestamp":"2023-03-06T09:36:24.797+0530","log.logger":"esclientleg","log.origin":{"file.name":"eslegc\>  
Mar 06 09:36:24 ekb02 metricbeat[1329274]: {"log.level":"warn","@timestamp":"2023-03-06T09:36:24.797+0530","log.logger":"tls","log.origin":{"file.name":"tlscommon/tls\_\>  
Mar 06 09:36:24 ekb02 metricbeat[1329274]: {"log.level":"info","@timestamp":"2023-03-06T09:36:24.798+0530","log.logger":"esclientleg","log.origin":{"file.name":"eslegc\>  
Mar 06 09:36:24 ekb02 metricbeat[1329274]: {"log.level":"warn","@timestamp":"2023-03-06T09:36:24.798+0530","log.logger":"tls","log.origin":{"file.name":"tlscommon/tls\_\>  
Mar 06 09:36:24 ekb02 metricbeat[1329274]: {"log.level":"info","@timestamp":"2023-03-06T09:36:24.798+0530","log.logger":"esclientleg","log.origin":{"file.name":"eslegc\>  
Mar 06 09:36:24 ekb02 metricbeat[1329274]: {"log.level":"warn","@timestamp":"2023-03-06T09:36:24.798+0530","log.logger":"tls","log.origin":{"file.name":"tlscommon/tls\_\>  
Mar 06 09:36:24 ekb02 metricbeat[1329274]: {"log.level":"info","@timestamp":"2023-03-06T09:36:24.798+0530","log.logger":"esclientleg","log.origin":{"file.name":"eslegc\>  
Mar 06 09:36:24 ekb02 metricbeat[1329274]: {"log.level":"warn","@timestamp":"2023-03-06T09:36:24.798+0530","log.logger":"tls","log.origin":{"file.name":"tlscommon/tls\_\>  
Mar 06 09:36:24 ekb02 metricbeat[1329274]: {"log.level":"info","@timestamp":"2023-03-06T09:36:24.798+0530","log.logger":"esclientleg","log.origin":{"file.name":"eslegc\>  
Mar 06 09:36:24 ekb02 metricbeat[1329274]: {"log.level":"warn","@timestamp":"2023-03-06T09:36:24.798+0530","log.logger":"tls","log.origin":{"file.name":"tlscommon/tls\_\>  
Mar 06 09:36:24 ekb02 metricbeat[1329274]: {"log.level":"info","@timestamp":"2023-03-06T09:36:24.798+0530","log.logger":"esclientleg","log.origin":{"file.name":"eslegc\>  
Mar 06 09:36:24 ekb02 metricbeat[1329274]: {"log.level":"warn","@timestamp":"2023-03-06T09:36:24.798+0530","log.logger":"tls","log.origin":{"file.name":"tlscommon/tls\_\>  
Mar 06 09:36:24 ekb02 metricbeat[1329274]: {"log.level":"info","@timestamp":"2023-03-06T09:36:24.798+0530","log.logger":"esclientleg","log.origin":{"file.name":"eslegc\>  
Mar 06 09:36:24 ekb02 metricbeat[1329274]: {"log.level":"warn","@timestamp":"2023-03-06T09:36:24.798+0530","log.logger":"tls","log.origin":{"file.name":"tlscommon/tls\_\>  
Mar 06 09:36:24 ekb02 metricbeat[1329274]: {"log.level":"info","@timestamp":"2023-03-06T09:36:24.798+0530","log.logger":"esclientleg","log.origin":{"file.name":"eslegc\>  
Mar 06 09:36:24 ekb02 metricbeat[1329274]: {"log.level":"warn","@timestamp":"2023-03-06T09:36:24.798+0530","log.logger":"tls","log.origin":{"file.name":"tlscommon/tls\_\>  
Mar 06 09:36:24 ekb02 metricbeat[1329274]: {"log.level":"info","@timestamp":"2023-03-06T09:36:24.798+0530","log.logger":"esclientleg","log.origin":{"file.name":"eslegc\>  
Mar 06 09:36:24 ekb02 metricbeat[1329274]: {"log.level":"warn","@timestamp":"2023-03-06T09:36:24.798+0530","log.logger":"tls","log.origin":{"file.name":"tlscommon/tls\_\>  
Mar 06 09:36:24 ekb02 metricbeat[1329274]: {"log.level":"info","@timestamp":"2023-03-06T09:36:24.798+0530","log.logger":"publisher","log.origin":{"file.name":"pipeline

root@ekb02:/nfs/ekb\_bkp/ekb\_scripts# systemctl status metricbeat.service  
● metricbeat.service - Metricbeat is a lightweight shipper for metrics.  
Loaded: loaded (/lib/systemd/system/metricbeat.service; enabled; vendor preset: enabled)  
Active: active (running) since Mon 2023-03-06 12:22:12 IST; 2s ago  
Docs: [Metricbeat: Lightweight Shipper for Metrics | Elastic](https://www.elastic.co/beats/metricbeat)  
Main PID: 1364180 (metricbeat)  
Tasks: 11 (limit: 19066)  
Memory: 39.8M  
CGroup: /system.slice/metricbeat.service  
└─1364180 /usr/share/metricbeat/bin/metricbeat --environment systemd -c /etc/metricbeat/metricbeat.yml --path.home /usr/share/metricbeat --path.config /et\>

Mar 06 12:22:12 ekb02 systemd[1]: Started Metricbeat is a lightweight shipper for metrics..  
Mar 06 12:22:13 ekb02 metricbeat[1364180]: {"log.level":"info","@timestamp":"2023-03-06T12:22:13.033+0530","log.origin":{"file.name":"instance/beat.go","file.line":724\>  
Mar 06 12:22:13 ekb02 metricbeat[1364180]: {"log.level":"info","@timestamp":"2023-03-06T12:22:13.033+0530","log.origin":{"file.name":"instance/beat.go","file.line":732\>  
lines 1-13/13 (END)

Please assist how can I go for its logs.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 3, 2023, 6:53am UTC](https://discuss.elastic.co/t/metricbeat-services-restarted-automatically/326822/6 "2023-04-03T06:53:46Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
