# Sometimes filebeat stops collecting/flushing events

**URL:** <https://discuss.elastic.co/t/sometimes-filebeat-stops-collecting-flushing-events/266187>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [March 4, 2021, 6:59am UTC](https://discuss.elastic.co/t/sometimes-filebeat-stops-collecting-flushing-events/266187 "2021-03-04T06:59:34Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![M0rdecay](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/m0rdecay/32/84928_2.png) [@M0rdecay](https://discuss.elastic.co/u/M0rdecay)\
**Post date:** [March 4, 2021, 6:59am UTC](https://discuss.elastic.co/t/sometimes-filebeat-stops-collecting-flushing-events/266187/1 "2021-03-04T06:59:34Z")

</div>

Hello!  
Please help me figure out the situation

Sometimes Filebeat stops collecting/flushing events. On the graph, it looks like this:

 ![filebeat_issue_1](https://us1.discourse-cdn.com/elastic/original/3X/6/7/67bdcbc8d706ddf659a1c2d17952188a49d43ad9.png)

This does not look like a problem with one of the inputs, since events stop coming from all at once. There are no errors in the log during this time, only metrics.  
Also, there are no errors in Logstash.

Filebeat version - 7.7.1  
Main config:

```auto
path.home: /log/filebeat
path.logs: ${path.home}/logs
path.data: ${path.home}/data

logging.level: info

filebeat.config.modules:
  path: ${path.home}/modules.d/*.yml
  reload.enabled: false

filebeat.config.inputs:
  enabled: true
  path: ${path.home}/conf/*.d/*.yml

fields_under_root: true
fields:
  stand_name: "develop_01"

output.logstash:
  hosts: [
    "logstash.host.local:5044",
  ]
  loadbalance: true

```

And all inputs looks like this one:

```auto
- type: log
  paths:
    - "/logs/zookeeper/zookeeper_server/zookeeper.log"
  multiline:
    pattern: '^[0-9]{4}'
    negate: true
    match: after
  fields_under_root: true

```

After restarting, Filebeat collects/flushes missing events and continues as normal.  
The described situation happens approximately once every 15-16 hours, during this time all log files are rotated several times.

Has anyone encountered such a situation?

---

<div class="post-metadata">

**Author:** ![mtojek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mtojek/32/63863_2.png) [@mtojek](https://discuss.elastic.co/u/mtojek)\
**Post date:** [March 4, 2021, 9:48am UTC](https://discuss.elastic.co/t/sometimes-filebeat-stops-collecting-flushing-events/266187/2 "2021-03-04T09:48:50Z")

</div>

Where do you store these files? Is it some kind of NFS or other share? Are you using log rotation?

---

<div class="post-metadata">

**Author:** ![M0rdecay](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/m0rdecay/32/84928_2.png) [@M0rdecay](https://discuss.elastic.co/u/M0rdecay)\
**Post date:** [March 4, 2021, 10:17am UTC](https://discuss.elastic.co/t/sometimes-filebeat-stops-collecting-flushing-events/266187/3 "2021-03-04T10:17:34Z")

</div>

Log files are stored on local disk

Logs rotation is used, but it is performed at different times for different files

In 15-16 hours of Filebeat working without troubles, rotation is performed several times

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 1, 2021, 12:18pm UTC](https://discuss.elastic.co/t/sometimes-filebeat-stops-collecting-flushing-events/266187/4 "2021-04-01T12:18:32Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.