Still Getting Data after filebeat and logstash are killed

[shrikantgulia (Shrikant)]

Hello,

I am still getting data in elasticsearch index after killing logstash and filebeat and when i am checking the PID of logsatsh and filebeat its showing that both are not working but i am still getting the data
Can someone suggest me why is it so.

Regards

[dadoonet (David Pilato)]

Getting data in which index?

[shrikantgulia (Shrikant)]

Hello @dadoonet
Thanks for the response I created a config file in logstash and also created a script to run logstash in the backend
In the logstash I am getting data from 3 different instances and I am seprating data output to 3 different indices.
I applied a loop.

Due to certain reasons I had to kill the filebeat and logstash and even I after deleting the registry file in filebeat and I am getting the data and data is getting Indexed in my indices.

[dadoonet (David Pilato)]

Can you share an example of a document which has been added after you stopped?

Also run the following before stopping and after:

GET _cat/indices?v

[shrikantgulia (Shrikant)]

Result for the Command GET _cat/indices?v is:

yellow open index_name 8D_2_1NhTLG3GzA0zwTihQ 5 2 8671874 2780751 32.3gb 32.3gb

and sample logs which I am getting after stopping beat is:

• Table
• JSON

@timestamp		April 22nd 2019, 00:04:31.000
t @version		1
t _id		rS0tQWoBh0F81AmWuLZK
t _index		index_name
# _score		-
t _type		doc
t beat.hostname		sdsdasrm
t beat.name		*wfbhidksbcds
t beat.version		6.5.2
t channel_name
t client_id		16
created		April 22nd 2019, 00:04:31.000
t fields.service_id		jaL-IGoBnxDLvH1bMmaP
t host.name		jfjksddsdas
# id		57,182,979

|t tags||beats_input_codec_plain_applied|

[dadoonet (David Pilato)]

Not sure about what you are meaning.
But could you run again the same cat command I pasted before and after stopping. And again after 1 minute.
And share all the 3 outputs here.