[Solved] Data path already locked by another beat

Elastic Stack Beats
1

I'm not particularly sure what to do about the following error. I've read a few things and everyone seems to say that it's either a failed shutdown or second instance. However none of my troubleshooting has rendered results. Maybe there is a path being pulled in by another system, but not beats from what I can tell.

2021-01-24T02:21:36.654Z        INFO    instance/beat.go:645    Home path: [/usr/share/filebeat] Config path: [/etc/filebeat] Data path: [/var/lib/filebeat] Logs path: [/var/log/filebeat]
2021-01-24T02:21:36.655Z        INFO    instance/beat.go:653    Beat ID: 3069bcba-8e20-429f-8d2e-5030c0d1aad2
2021-01-24T02:21:36.660Z        INFO    instance/beat.go:392    filebeat stopped.
2021-01-24T02:21:36.660Z        ERROR   instance/beat.go:956    Exiting: data path already locked by another beat. Please make sure that multiple beats are not sharing the same data path (path.data).
Exiting: data path already locked by another beat. Please make sure that multiple beats are not sharing the same data path (path.data).
  • I've restarted (and stopped/started separately) the Service,
  • Don't see a second service for filebeat or anything else with "beat" in the name of services running.
  • I wasn't getting this error when filebeat was going straight through to Elasticsearch, however I wanted to have it go to logstash first (and in the future other plugins/beats for their own indices to visualize in kibana later). Now that I've switched some of the filebeats.yml file, this has started.

filebeat.yml:

filebeat.inputs:

- module: system
  # Syslog
  syslog:
    enabled: true

  auth:
    enabled: true

filebeat.config.modules:
  path: ${path.config}/modules.d/*.yml
  reload.enabled: false

#setup.template.name: "nginx"
#setup.template.pattern: "nginx-%{[agent.version]}-%{+yyyy.MM.dd}-*"

#setup.template.settings:
#  index.number_of_shards: 1

setup.kibana:
  host: http://134.122.15.171:5601
  username: "${KIBANA_USER}"
  password: "${KIBANA_PWD}"

#output.elasticsearch:
#  hosts: ["localhost:9200"]
#  index: "nginx-%{+yyyy.MM.dd}"
#  username: "${ES_USER}"
#  password: "${ES_PWD}"

output.logstash:
   enabled: true
   hosts: ["localhost:5044"]
   index: 'filebeat'

processors:
  - add_host_metadata:
      when.not.contains.tags: forwarded
  - add_cloud_metadata: ~
  - add_docker_metadata: ~
  - add_kubernetes_metadata: ~

modules.d/nginx.yml:

# Module: nginx
# Docs: https://www.elastic.co/guide/en/beats/filebeat/7.10/filebeat-module-nginx.html

- module: nginx
  # Access logs
  access:
    enabled: true

    # Set custom paths for the log files. If left empty,
    # Filebeat will choose the paths depending on your OS.
    #var.paths: ["/var/log/nginx/access.log*"]

  # Error logs
  error:
    enabled: true

    # Set custom paths for the log files. If left empty,
    # Filebeat will choose the paths depending on your OS.
    #var.paths:["/var/log/nginx/error.log*"]

  # Ingress-nginx controller logs. This is disabled by default. It could be used in Kubernetes environments to parse ingress-nginx logs
  ingress_controller:
    enabled: false

    # Set custom paths for the log files. If left empty,
    # Filebeat will choose the paths depending on your OS.
    #var.paths:

This occurs when I run filebeat -e, I try to run filebeat setup -e and that seems to trigger another issue shown below:

ERROR   instance/beat.go:956    Exiting: Index management requested but the Elasticsearch output is not configured/enabled
Exiting: Index management requested but the Elasticsearch output is not configured/enabled

Please let me know if there are other log/config files you would like me to include and I certainly can add them here.

2

Ignore me, while I'm on to new issues, the solution was just to restart all of my Elastic Stack in this order:
Elasticsearch
Kibana
Logstash
Filebeat

1 Like
3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.