Sometimes filebeat stops collecting/flushing events

Please help me figure out the situation

Sometimes Filebeat stops collecting/flushing events. On the graph, it looks like this:

This does not look like a problem with one of the inputs, since events stop coming from all at once. There are no errors in the log during this time, only metrics.
Also, there are no errors in Logstash.

Filebeat version - 7.7.1
Main config:

path.home: /log/filebeat
path.logs: ${path.home}/logs ${path.home}/data

logging.level: info

  path: ${path.home}/modules.d/*.yml
  reload.enabled: false

  enabled: true
  path: ${path.home}/conf/*.d/*.yml

fields_under_root: true
  stand_name: "develop_01"

  hosts: [
  loadbalance: true

And all inputs looks like this one:

- type: log
    - "/logs/zookeeper/zookeeper_server/zookeeper.log"
    pattern: '^[0-9]{4}'
    negate: true
    match: after
  fields_under_root: true

After restarting, Filebeat collects/flushes missing events and continues as normal.
The described situation happens approximately once every 15-16 hours, during this time all log files are rotated several times.

Has anyone encountered such a situation?

Where do you store these files? Is it some kind of NFS or other share? Are you using log rotation?

Log files are stored on local disk

Logs rotation is used, but it is performed at different times for different files

In 15-16 hours of Filebeat working without troubles, rotation is performed several times

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.