Still Getting Data after filebeat and logstash are killed

Elastic Stack Elasticsearch
1

Hello,

I am still getting data in elasticsearch index after killing logstash and filebeat and when i am checking the PID of logsatsh and filebeat its showing that both are not working but i am still getting the data
Can someone suggest me why is it so.

Regards

2

Getting data in which index?

3

Hello @dadoonet
Thanks for the response I created a config file in logstash and also created a script to run logstash in the backend
In the logstash I am getting data from 3 different instances and I am seprating data output to 3 different indices.
I applied a loop.

Due to certain reasons I had to kill the filebeat and logstash and even I after deleting the registry file in filebeat and I am getting the data and data is getting Indexed in my indices.

4

Can you share an example of a document which has been added after you stopped?

Also run the following before stopping and after:

GET _cat/indices?v
5

Result for the Command GET _cat/indices?v is:

yellow open index_name 8D_2_1NhTLG3GzA0zwTihQ 5 2 8671874 2780751 32.3gb 32.3gb

and sample logs which I am getting after stopping beat is:

  • Table
  • JSON
@timestamp April 22nd 2019, 00:04:31.000
t @version 1
t _id rS0tQWoBh0F81AmWuLZK
t _index index_name
# _score -
t _type doc
t beat.hostname sdsdasrm
t beat.name *wfbhidksbcds
t beat.version 6.5.2
t channel_name
t client_id 16
created April 22nd 2019, 00:04:31.000
t fields.service_id jaL-IGoBnxDLvH1bMmaP
t host.name jfjksddsdas
# id 57,182,979

|t tags||beats_input_codec_plain_applied|

6

Not sure about what you are meaning.
But could you run again the same cat command I pasted before and after stopping. And again after 1 minute.
And share all the 3 outputs here.

7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.