Stopping filebeats affects metricbeat http module

ppic · June 7, 2023, 8:43am

Hello,

I use Elasticsearch 7.17.6 on a WIndows server.
I started two services : metricbeat and filebeat

metricbeat runs modules : system, sql and http
- metricbeat-http tests http routes every minute
filebeat was used for IIS, but is no more usefull.

I stopped the filebeat service, as it was useless.
Then Kibana stopped displaying the http data (in Discover as in lenses)

After some minutes, I restarted the filebeat service.
Then the missing data have reappeared

So I have to leave the filebeat service running to get the metricbeat-http data.
The metricbeat modules sql and system are not affected, only the http module.
Something wrong in the config ?
Thank you for your help.

xeraa · June 7, 2023, 11:11pm

Can you share the config, please? Filebeat could also run the HTTP module (HTTP JSON input | Filebeat Reference [8.8] | Elastic), so as a first step I‘d double check that this isn‘t running the module

After that, the Metricbeat config and log would be helpful.

ppic · June 8, 2023, 9:28am

Thank you for taking care of my case.

Here are the config files (I have removed the commented lines)

C:\Program Files\metricbeat\metricbeat.yml :

metricbeat.config.modules:
  path: ${path.config}/modules.d/*.yml
  reload.enabled: false

setup.template.settings:
  index.number_of_shards: 1
  index.codec: best_compression

setup.kibana:
  host: "https://edaas-noprod.kb.elasticaas.ocb.equant.com:9243"
  space.id: "xconf-qa"
  protocol: "https"
  username: "xconf-qa-write"
  password: "****************"
  ssl.verification_mode: none

output.elasticsearch:
  hosts: ["edaas-noprod.es.elasticaas.ocb.equant.com:9243"]
  protocol: "https"
  username: "xconf-qa-write"
  password: "**************"
  ssl.verification_mode: none
  index: "xconf-qa-%{[agent.version]}-%{+yyyy.MM.dd}"

setup.template.name: "xconf-qa"
setup.template.pattern: "xconf-qa-*"
setup.dashboards.index: "xconf-qa-*"
setup.template.enabled: false

setup.ilm.enabled: false

xpack.ml.enabled: false

processors:
  - add_host_metadata: ~
  - add_cloud_metadata: ~
  - add_docker_metadata: ~
  - add_kubernetes_metadata: ~

C:\Program Files\metricbeat\metricbeat.yml :

metricbeat.config.modules:
  path: ${path.config}/modules.d/*.yml
  reload.enabled: false

setup.template.settings:
  index.number_of_shards: 1
  index.codec: best_compression

setup.kibana:
  host: "https://edaas-noprod.kb.elasticaas.ocb.equant.com:9243"
  space.id: "xconf-qa"
  protocol: "https"
  username: "xconf-qa-write"
  password: "****************"
  ssl.verification_mode: none

output.elasticsearch:
  hosts: ["edaas-noprod.es.elasticaas.ocb.equant.com:9243"]
  protocol: "https"
  username: "xconf-qa-write"
  password: "**********"
  ssl.verification_mode: none
  index: "xconf-qa-%{[agent.version]}-%{+yyyy.MM.dd}"

setup.template.name: "xconf-qa"
setup.template.pattern: "xconf-qa-*"
setup.dashboards.index: "xconf-qa-*"
setup.template.enabled: false

setup.ilm.enabled: false

xpack.ml.enabled: false

processors:
  - add_host_metadata: ~
  - add_cloud_metadata: ~
  - add_docker_metadata: ~
  - add_kubernetes_metadata: ~

C:\Program Files\metricbeat\modules.d\http.yml :

- module: http
  metricsets:
    - json
  period: 60s
  hosts: ["xconf-qa.equant.com:8080"]
  namespace: "json_namespace"
  path: "/Ping"

- module: http
  metricsets:
    - json
  period: 60s
  hosts: ["xconf-qa.equant.com"]
  namespace: "json_namespace"
  path: "/XCONF"

- module: http
  metricsets:
    - json
  period: 60s
  hosts: ["xconf-qa.equant.com"]
  namespace: "json_namespace"
  path: "/XCONF.API/api/Test"

- module: http
  metricsets:
    - json
  period: 60s
  hosts: ["xconf-qa.equant.com"]
  namespace: "json_namespace"
  path: "/XConfWebAPI/info/warningCodes"
  
- module: http
  host: "localhost"
  port: "8080"
  enabled: false

C:\Program Files\filebeat\filebeat.yml :

filebeat.inputs:

- type: filestream
  id: my-filestream-id
  enabled: false
  paths:

filebeat.config.modules:
  path: C:/Program Files/filebeat/modules.d/*.yml
  reload.enabled: false

setup.template.settings:
  index.number_of_shards: 1

setup.kibana:
  host: "https://edaas-noprod.kb.elasticaas.ocb.equant.com:9243"
  space.id: "xconf-qa"
  protocol: "https"
  username: "xconf-qa-write"
  password: "*************"
  ssl.verification_mode: none

output.elasticsearch:
  hosts: ["edaas-noprod.es.elasticaas.ocb.equant.com:9243"]
  protocol: "https"
  username: "xconf-qa-write"
  password: "*************"
  ssl.verification_mode: none

output.elasticsearch.index: "xconf-qa-%{[agent.version]}-%{+yyyy.MM.dd}"
setup.template.name: "xconf-qa"
setup.template.pattern: "xconf-qa-*"
setup.dashboards.index: "xconf-qa-*"
setup.template.enabled: false

setup.ilm.enabled: false
xpack.ml.enabled: false

processors:
  - add_host_metadata:
      when.not.contains.tags: forwarded
  - add_cloud_metadata: ~
  - add_docker_metadata: ~
  - add_kubernetes_metadata: ~

I have stopped the filebeat service around 2023-06-08T08:47
and restarted it around 2023-06-08T09:07

The metricbeat and filebeat log files will follow in a next post (limitation to 35000 characters)

ppic · June 8, 2023, 9:49am

metricbeat log files.
(I have stopped the filebeat service around 2023-06-08T08:47
and restarted it around 2023-06-08T09:07)

I have removed the similar lines, replaced with something like "(.... ~100 similar lines ....)"

C:\ProgramData\metricbeat\logs\metricbeat :

2023-06-08T08:40:14.372Z	INFO	instance/beat.go:685	Home path: [C:\Program Files\metricbeat] Config path: [C:\Program Files\metricbeat] Data path: [C:\ProgramData\metricbeat] Logs path: [C:\ProgramData\metricbeat\logs] Hostfs Path: [/]
2023-06-08T08:40:14.426Z	INFO	instance/beat.go:693	Beat ID: 5048a83f-d60e-48cd-a51f-21973dd3f7fb
2023-06-08T08:40:14.441Z	WARN	[add_cloud_metadata]	add_cloud_metadata/provider_aws_ec2.go:79	read token request for getting IMDSv2 token returns empty: Put "http://169.254.169.254/latest/api/token": dial tcp 169.254.169.254:80: connectex: A socket operation was attempted to an unreachable network.. No token in the metadata request will be used.
2023-06-08T08:40:14.442Z	INFO	[beat]	instance/beat.go:1039	Beat info	{"system_info": {"beat": {"path": {"config": "C:\\Program Files\\metricbeat", "data": "C:\\ProgramData\\metricbeat", "home": "C:\\Program Files\\metricbeat", "logs": "C:\\ProgramData\\metricbeat\\logs"}, "type": "metricbeat", "uuid": "5048a83f-d60e-48cd-a51f-21973dd3f7fb"}}}
2023-06-08T08:40:14.442Z	INFO	[beat]	instance/beat.go:1048	Build info	{"system_info": {"build": {"commit": "121b2ab96f118e6999f0a4be8e98827a809337db", "libbeat": "7.17.6", "time": "2022-08-23T12:50:11.000Z", "version": "7.17.6"}}}
2023-06-08T08:40:14.442Z	INFO	[beat]	instance/beat.go:1051	Go runtime info	{"system_info": {"go": {"os":"windows","arch":"amd64","max_procs":4,"version":"go1.18.2"}}}
2023-06-08T08:40:14.442Z	INFO	[add_cloud_metadata]	add_cloud_metadata/add_cloud_metadata.go:101	add_cloud_metadata: hosting provider type not detected.
2023-06-08T08:40:14.449Z	INFO	[beat]	instance/beat.go:1055	Host info	{"system_info": {"host": {"architecture":"x86_64","boot_time":"2023-05-07T04:33:39Z","name":"S01223L","ip":["fe80::9184:1054:df0c:2787/64","10.229.25.26/21","10.238.116.238/26","::1/128","127.0.0.1/8","fe80::5efe:ae5:191a/128"],"kernel_version":"6.3.9600.20876 (winblue_ltsb_escrow.230301-1746)","mac":["00:50:56:01:0a:88","00:50:56:01:85:b5","00:00:00:00:00:00:00:e0","00:00:00:00:00:00:00:e0"],"os":{"type":"windows","family":"windows","platform":"windows","name":"Windows Server 2012 R2 Standard","version":"6.3","major":3,"minor":0,"patch":0,"build":"9600.19505"},"timezone":"GMT","timezone_offset_sec":0,"id":"094a2ecc-a3fd-40e3-a860-e21f3a0874ec"}}}
2023-06-08T08:40:14.449Z	INFO	[beat]	instance/beat.go:1084	Process info	{"system_info": {"process": {"cwd": "C:\\windows\\system32", "exe": "C:\\Program Files\\metricbeat\\metricbeat.exe", "name": "metricbeat.exe", "pid": 9268, "ppid": 608, "start_time": "2023-06-08T08:40:13.095Z"}}}
2023-06-08T08:40:14.449Z	INFO	instance/beat.go:328	Setup Beat: metricbeat; Version: 7.17.6
2023-06-08T08:40:14.450Z	WARN	[cfgwarn]	tlscommon/config.go:100	DEPRECATED: Treating the CommonName field on X.509 certificates as a host name when no Subject Alternative Names are present is going to be removed. Please update your certificates if needed. Will be removed in version: 8.0.0
2023-06-08T08:40:14.450Z	INFO	[esclientleg]	eslegclient/connection.go:105	elasticsearch url: https://edaas-noprod.es.elasticaas.ocb.equant.com:9243
2023-06-08T08:40:14.450Z	WARN	[tls]	tlscommon/tls_config.go:101	SSL/TLS verifications disabled.
2023-06-08T08:40:14.450Z	INFO	[publisher]	pipeline/module.go:113	Beat name: S01223L
2023-06-08T08:40:14.495Z	INFO	[monitoring]	log/log.go:142	Starting metrics logging every 30s
2023-06-08T08:40:14.495Z	INFO	kibana/client.go:180	Kibana url: https://edaas-noprod.kb.elasticaas.ocb.equant.com:9243/s/xconf-qa
2023-06-08T08:40:14.495Z	WARN	[tls]	tlscommon/tls_config.go:101	SSL/TLS verifications disabled.
2023-06-08T08:40:14.495Z	WARN	[tls]	tlscommon/tls_config.go:101	SSL/TLS verifications disabled.
2023-06-08T08:40:15.064Z	INFO	kibana/client.go:180	Kibana url: https://edaas-noprod.kb.elasticaas.ocb.equant.com:9243/s/xconf-qa
2023-06-08T08:40:15.065Z	WARN	[tls]	tlscommon/tls_config.go:101	SSL/TLS verifications disabled.
2023-06-08T08:40:15.065Z	WARN	[tls]	tlscommon/tls_config.go:101	SSL/TLS verifications disabled.
2023-06-08T08:40:44.498Z	INFO	[monitoring]	log/log.go:184	Non-zero metrics in the last 30s	{"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":296,"time":{"ms":296}},"total":{"ticks":1077,"time":{"ms":1077},"value":1077},"user":{"ticks":781,"time":{"ms":781}}},"handles":{"open":191},"info":{"ephemeral_id":"96729b1b-bc88-4ac7-93c5-1efd12a6739f","uptime":{"ms":30909},"version":"7.17.6"},"memstats":{"gc_next":28467800,"memory_alloc":20670880,"memory_sys":59507128,"memory_total":155839232,"rss":76066816},"runtime":{"goroutines":25}},"libbeat":{"config":{"module":{"running":0}},"output":{"events":{"active":0},"type":"elasticsearch"},"pipeline":{"clients":0,"events":{"active":0},"queue":{"max_events":4096}}},"system":{"cpu":{"cores":4}}}}}
(.... 4 similar lines ....)
2023-06-08T08:43:14.433Z	INFO	[monitoring]	log/log.go:184	Non-zero metrics in the last 30s	{"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":1312,"time":{"ms":250}},"total":{"ticks":2983,"time":{"ms":437},"value":2983},"user":{"ticks":1671,"time":{"ms":187}}},"handles":{"open":191},"info":{"ephemeral_id":"96729b1b-bc88-4ac7-93c5-1efd12a6739f","uptime":{"ms":180909},"version":"7.17.6"},"memstats":{"gc_next":22061752,"memory_alloc":17141656,"memory_total":243613512,"rss":65146880},"runtime":{"goroutines":23}},"libbeat":{"config":{"module":{"running":0}},"output":{"events":{"active":0}},"pipeline":{"clients":0,"events":{"active":0}}}}}}
2023-06-08T08:43:33.225Z	INFO	instance/beat.go:868	Kibana dashboards successfully loaded.
2023-06-08T08:43:33.225Z	INFO	instance/beat.go:492	metricbeat start running.
2023-06-08T08:43:33.228Z	WARN	[cfgwarn]	query/query.go:52	BETA: The sql query metricset is beta.
2023-06-08T08:43:33.228Z	WARN	[cfgwarn]	query/query.go:52	BETA: The sql query metricset is beta.
2023-06-08T08:43:33.231Z	INFO	helper/privileges_windows.go:79	Metricbeat process and system info: {"OSVersion":{"Major":6,"Minor":2,"Build":9200},"Arch":"amd64","NumCPU":4,"User":{"SID":"S-1-5-18","Account":"SYSTEM","Domain":"NT AUTHORITY","Type":1},"ProcessPrivs":{"SeAssignPrimaryTokenPrivilege":{"enabled":false},"SeAuditPrivilege":{"enabled_by_default":true,"enabled":true},"SeBackupPrivilege":{"enabled":false},"SeChangeNotifyPrivilege":{"enabled_by_default":true,"enabled":true},"SeCreateGlobalPrivilege":{"enabled_by_default":true,"enabled":true},"SeCreatePagefilePrivilege":{"enabled_by_default":true,"enabled":true},"SeCreatePermanentPrivilege":{"enabled_by_default":true,"enabled":true},"SeCreateSymbolicLinkPrivilege":{"enabled_by_default":true,"enabled":true},"SeDebugPrivilege":{"enabled_by_default":true,"enabled":true},"SeImpersonatePrivilege":{"enabled_by_default":true,"enabled":true},"SeIncreaseBasePriorityPrivilege":{"enabled_by_default":true,"enabled":true},"SeIncreaseQuotaPrivilege":{"enabled":false},"SeIncreaseWorkingSetPrivilege":{"enabled_by_default":true,"enabled":true},"SeLoadDriverPrivilege":{"enabled":false},"SeLockMemoryPrivilege":{"enabled_by_default":true,"enabled":true},"SeManageVolumePrivilege":{"enabled":false},"SeProfileSingleProcessPrivilege":{"enabled_by_default":true,"enabled":true},"SeRestorePrivilege":{"enabled":false},"SeSecurityPrivilege":{"enabled":false},"SeShutdownPrivilege":{"enabled":false},"SeSystemEnvironmentPrivilege":{"enabled":false},"SeSystemProfilePrivilege":{"enabled_by_default":true,"enabled":true},"SeSystemtimePrivilege":{"enabled":false},"SeTakeOwnershipPrivilege":{"enabled":false},"SeTcbPrivilege":{"enabled_by_default":true,"enabled":true},"SeTimeZonePrivilege":{"enabled_by_default":true,"enabled":true},"SeUndockPrivilege":{"enabled":false}}}
2023-06-08T08:43:33.231Z	INFO	helper/privileges_windows.go:87	SeDebugPrivilege is enabled. SeDebugPrivilege=(Default, Enabled)
2023-06-08T08:43:33.232Z	INFO	cfgfile/reload.go:164	Config reloader started
2023-06-08T08:43:33.235Z	WARN	[cfgwarn]	query/query.go:52	BETA: The sql query metricset is beta.
2023-06-08T08:43:33.236Z	ERROR	[reload]	cfgfile/list.go:108	Error creating runner from config: disabled module
2023-06-08T08:43:33.236Z	WARN	[cfgwarn]	query/query.go:52	BETA: The sql query metricset is beta.
2023-06-08T08:43:33.236Z	INFO	cfgfile/reload.go:224	Loading of config files completed.
2023-06-08T08:43:33.267Z	ERROR	module/wrapper.go:259	Error fetching data for metricset http.json: json: cannot unmarshal bool into Go value of type common.MapStr
2023-06-08T08:43:33.344Z	ERROR	module/wrapper.go:259	Error fetching data for metricset http.json: invalid character '<' looking for beginning of value
2023-06-08T08:43:34.249Z	INFO	[publisher_pipeline_output]	pipeline/output.go:143	Connecting to backoff(elasticsearch(https://edaas-noprod.es.elasticaas.ocb.equant.com:9243))
2023-06-08T08:43:34.249Z	INFO	[publisher]	pipeline/retry.go:219	retryer: send unwait signal to consumer
2023-06-08T08:43:34.249Z	INFO	[publisher]	pipeline/retry.go:223	  done
2023-06-08T08:43:34.249Z	WARN	[tls]	tlscommon/tls_config.go:101	SSL/TLS verifications disabled.
2023-06-08T08:43:34.274Z	INFO	[esclientleg]	eslegclient/connection.go:285	Attempting to connect to Elasticsearch version 7.17.1
2023-06-08T08:43:34.291Z	INFO	[publisher_pipeline_output]	pipeline/output.go:151	Connection to backoff(elasticsearch(https://edaas-noprod.es.elasticaas.ocb.equant.com:9243)) established
2023-06-08T08:43:44.425Z	INFO	[monitoring]	log/log.go:184	Non-zero metrics in the last 30s	{"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":1625,"time":{"ms":313}},"total":{"ticks":3593,"time":{"ms":610},"value":3593},"user":{"ticks":1968,"time":{"ms":297}}},"handles":{"open":206},"info":{"ephemeral_id":"96729b1b-bc88-4ac7-93c5-1efd12a6739f","uptime":{"ms":210908},"version":"7.17.6"},"memstats":{"gc_next":21221528,"memory_alloc":13757544,"memory_total":265383192,"rss":64233472},"runtime":{"goroutines":89}},"libbeat":{"config":{"module":{"running":9,"starts":9},"reloads":1,"scans":1},"output":{"events":{"acked":62,"active":0,"batches":2,"total":62},"read":{"bytes":4103},"write":{"bytes":114939}},"pipeline":{"clients":15,"events":{"active":0,"published":62,"retry":44,"total":62},"queue":{"acked":62}}},"metricbeat":{"http":{"json":{"events":4,"failures":2,"success":2}},"sql":{"query":{"events":16,"success":16}},"system":{"cpu":{"events":2,"success":2},"filesystem":{"events":3,"success":3},"fsstat":{"events":1,"success":1},"memory":{"events":2,"success":2},"network":{"events":11,"success":11},"process":{"events":18,"success":18},"process_summary":{"events":2,"success":2},"socket_summary":{"events":2,"success":2},"uptime":{"events":1,"success":1}}}}}}
2023-06-08T08:44:14.420Z	INFO	[monitoring]	log/log.go:184	Non-zero metrics in the last 30s	{"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":1859,"time":{"ms":234}},"total":{"ticks":3968,"time":{"ms":375},"value":3968},"user":{"ticks":2109,"time":{"ms":141}}},"handles":{"open":206},"info":{"ephemeral_id":"96729b1b-bc88-4ac7-93c5-1efd12a6739f","uptime":{"ms":240908},"version":"7.17.6"},"memstats":{"gc_next":21152664,"memory_alloc":10363320,"memory_total":271559184,"rss":66330624},"runtime":{"goroutines":90}},"libbeat":{"config":{"module":{"running":9}},"output":{"events":{"acked":36,"active":18,"batches":3,"total":54},"read":{"bytes":1361},"write":{"bytes":79211}},"pipeline":{"clients":15,"events":{"active":18,"published":54,"total":54},"queue":{"acked":36}}},"metricbeat":{"system":{"cpu":{"events":3,"success":3},"memory":{"events":3,"success":3},"network":{"events":18,"success":18},"process":{"events":24,"success":24},"process_summary":{"events":3,"success":3},"socket_summary":{"events":3,"success":3}}}}}}
2023-06-08T08:44:33.262Z	ERROR	module/wrapper.go:259	Error fetching data for metricset http.json: json: cannot unmarshal bool into Go value of type common.MapStr
2023-06-08T08:44:33.364Z	ERROR	module/wrapper.go:259	Error fetching data for metricset http.json: invalid character '<' looking for beginning of value
2023-06-08T08:44:44.417Z	INFO	[monitoring]	log/log.go:184	Non-zero metrics in the last 30s	{"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":2187,"time":{"ms":328}},"total":{"ticks":4358,"time":{"ms":390},"value":4358},"user":{"ticks":2171,"time":{"ms":62}}},"handles":{"open":206},"info":{"ephemeral_id":"96729b1b-bc88-4ac7-93c5-1efd12a6739f","uptime":{"ms":270908},"version":"7.17.6"},"memstats":{"gc_next":21152664,"memory_alloc":18244136,"memory_total":279440000,"rss":66789376},"runtime":{"goroutines":89}},"libbeat":{"config":{"module":{"running":9}},"output":{"events":{"acked":95,"active":0,"batches":3,"total":77},"read":{"bytes":2862},"write":{"bytes":137168}},"pipeline":{"clients":15,"events":{"active":0,"published":77,"total":77},"queue":{"acked":95}}},"metricbeat":{"http":{"json":{"events":4,"failures":2,"success":2}},"sql":{"query":{"events":16,"success":16}},"system":{"cpu":{"events":3,"success":3},"filesystem":{"events":3,"success":3},"fsstat":{"events":1,"success":1},"memory":{"events":3,"success":3},"network":{"events":18,"success":18},"process":{"events":23,"success":23},"process_summary":{"events":3,"success":3},"socket_summary":{"events":3,"success":3}}}}}}
2023-06-08T08:45:14.412Z	INFO	[monitoring]	log/log.go:184	Non-zero metrics in the last 30s	{"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":2453,"time":{"ms":266}},"total":{"ticks":4749,"time":{"ms":391},"value":4749},"user":{"ticks":2296,"time":{"ms":125}}},"handles":{"open":205},"info":{"ephemeral_id":"96729b1b-bc88-4ac7-93c5-1efd12a6739f","uptime":{"ms":300908},"version":"7.17.6"},"memstats":{"gc_next":21568520,"memory_alloc":14066264,"memory_total":285736392,"rss":68116480},"runtime":{"goroutines":87}},"libbeat":{"config":{"module":{"running":9}},"output":{"events":{"acked":54,"active":0,"batches":3,"total":54},"read":{"bytes":2051},"write":{"bytes":79453}},"pipeline":{"clients":15,"events":{"active":0,"published":54,"total":54},"queue":{"acked":54}}},"metricbeat":{"system":{"cpu":{"events":3,"success":3},"memory":{"events":3,"success":3},"network":{"events":18,"success":18},"process":{"events":24,"success":24},"process_summary":{"events":3,"success":3},"socket_summary":{"events":3,"success":3}}}}}}
2023-06-08T08:45:33.253Z	ERROR	module/wrapper.go:259	Error fetching data for metricset http.json: json: cannot unmarshal bool into Go value of type common.MapStr
2023-06-08T08:45:33.350Z	ERROR	module/wrapper.go:259	Error fetching data for metricset http.json: invalid character '<' looking for beginning of value
(.... ~100 similar lines ....)
2023-06-08T09:12:44.396Z	INFO	[monitoring]	log/log.go:184	Non-zero metrics in the last 30s	{"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":15593,"time":{"ms":250}},"total":{"ticks":23858,"time":{"ms":406},"value":23858},"user":{"ticks":8265,"time":{"ms":156}}},"handles":{"open":207},"info":{"ephemeral_id":"96729b1b-bc88-4ac7-93c5-1efd12a6739f","uptime":{"ms":1950916},"version":"7.17.6"},"memstats":{"gc_next":21712056,"memory_alloc":12994872,"memory_total":677883240,"rss":67014656},"runtime":{"goroutines":87}},"libbeat":{"config":{"module":{"running":9}},"output":{"events":{"acked":96,"active":0,"batches":4,"total":78},"read":{"bytes":3440},"write":{"bytes":139069}},"pipeline":{"clients":15,"events":{"active":0,"published":78,"total":78},"queue":{"acked":96}}},"metricbeat":{"http":{"json":{"events":4,"failures":2,"success":2}},"sql":{"query":{"events":16,"success":16}},"system":{"cpu":{"events":3,"success":3},"filesystem":{"events":3,"success":3},"fsstat":{"events":1,"success":1},"memory":{"events":3,"success":3},"network":{"events":18,"success":18},"process":{"events":24,"success":24},"process_summary":{"events":3,"success":3},"socket_summary":{"events":3,"success":3}}}}}}
2023-06-08T09:13:14.397Z	INFO	[monitoring]	log/log.go:184	Non-zero metrics in the last 30s	{"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":15781,"time":{"ms":188}},"total":{"ticks":24109,"time":{"ms":235},"value":24109},"user":{"ticks":8328,"time":{"ms":47}}},"handles":{"open":207},"info":{"ephemeral_id":"96729b1b-bc88-4ac7-93c5-1efd12a6739f","uptime":{"ms":1980909},"version":"7.17.6"},"memstats":{"gc_next":21712056,"memory_alloc":19115312,"memory_total":684003680,"rss":68038656},"runtime":{"goroutines":87}},"libbeat":{"config":{"module":{"running":9}},"output":{"events":{"acked":54,"active":0,"batches":3,"total":54},"read":{"bytes":2044},"write":{"bytes":79177}},"pipeline":{"clients":15,"events":{"active":0,"published":54,"total":54},"queue":{"acked":54}}},"metricbeat":{"system":{"cpu":{"events":3,"success":3},"memory":{"events":3,"success":3},"network":{"events":18,"success":18},"process":{"events":24,"success":24},"process_summary":{"events":3,"success":3},"socket_summary":{"events":3,"success":3}}}}}}
2023-06-08T09:13:33.241Z	ERROR	module/wrapper.go:259	Error fetching data for metricset http.json: json: cannot unmarshal bool into Go value of type common.MapStr
2023-06-08T09:13:33.340Z	ERROR	module/wrapper.go:259	Error fetching data for metricset http.json: invalid character '<' looking for beginning of value
2023-06-08T09:13:44.397Z	INFO	[monitoring]	log/log.go:184	Non-zero metrics in the last 30s	{"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":16140,"time":{"ms":359}},"total":{"ticks":24593,"time":{"ms":484},"value":24593},"user":{"ticks":8453,"time":{"ms":125}}},"handles":{"open":207},"info":{"ephemeral_id":"96729b1b-bc88-4ac7-93c5-1efd12a6739f","uptime":{"ms":2010924},"version":"7.17.6"},"memstats":{"gc_next":21408936,"memory_alloc":9895232,"memory_total":691860264,"rss":66613248},"runtime":{"goroutines":88}},"libbeat":{"config":{"module":{"running":9}},"output":{"events":{"acked":60,"active":18,"batches":4,"total":78},"read":{"bytes":2048},"write":{"bytes":138545}},"pipeline":{"clients":15,"events":{"active":18,"published":78,"total":78},"queue":{"acked":60}}},"metricbeat":{"http":{"json":{"events":4,"failures":2,"success":2}},"sql":{"query":{"events":16,"success":16}},"system":{"cpu":{"events":3,"success":3},"filesystem":{"events":3,"success":3},"fsstat":{"events":1,"success":1},"memory":{"events":3,"success":3},"network":{"events":18,"success":18},"process":{"events":23,"success":23},"process_summary":{"events":3,"success":3},"socket_summary":{"events":3,"success":3},"uptime":{"events":1,"success":1}}}}}}
2023-06-08T09:14:14.398Z	INFO	[monitoring]	log/log.go:184	Non-zero metrics in the last 30s	{"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":16453,"time":{"ms":313}},"total":{"ticks":24999,"time":{"ms":406},"value":24999},"user":{"ticks":8546,"time":{"ms":93}}},"handles":{"open":207},"info":{"ephemeral_id":"96729b1b-bc88-4ac7-93c5-1efd12a6739f","uptime":{"ms":2040908},"version":"7.17.6"},"memstats":{"gc_next":21408936,"memory_alloc":16447120,"memory_total":698412152,"rss":66613248},"runtime":{"goroutines":87}},"libbeat":{"config":{"module":{"running":9}},"output":{"events":{"acked":74,"active":0,"batches":3,"total":56},"read":{"bytes":2752},"write":{"bytes":82404}},"pipeline":{"clients":15,"events":{"active":0,"published":56,"total":56},"queue":{"acked":74}}},"metricbeat":{"system":{"cpu":{"events":3,"success":3},"memory":{"events":3,"success":3},"network":{"events":18,"success":18},"process":{"events":26,"success":26},"process_summary":{"events":3,"success":3},"socket_summary":{"events":3,"success":3}}}}}}
2023-06-08T09:14:33.243Z	ERROR	module/wrapper.go:259	Error fetching data for metricset http.json: json: cannot unmarshal bool into Go value of type common.MapStr
2023-06-08T09:14:33.342Z	ERROR	module/wrapper.go:259	Error fetching data for metricset http.json: invalid character '<' looking for beginning of value
2023-06-08T09:14:44.399Z	INFO	[monitoring]	log/log.go:184	Non-zero metrics in the last 30s	{"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":16703,"time":{"ms":250}},"total":{"ticks":25421,"time":{"ms":422},"value":25421},"user":{"ticks":8718,"time":{"ms":172}}},"handles":{"open":207},"info":{"ephemeral_id":"96729b1b-bc88-4ac7-93c5-1efd12a6739f","uptime":{"ms":2070908},"version":"7.17.6"},"memstats":{"gc_next":21101304,"memory_alloc":14092880,"memory_total":706246888,"rss":68689920},"runtime":{"goroutines":87}},"libbeat":{"config":{"module":{"running":9}},"output":{"events":{"acked":78,"active":0,"batches":3,"total":78},"read":{"bytes":2189},"write":{"bytes":138514}},"pipeline":{"clients":15,"events":{"active":0,"published":78,"total":78},"queue":{"acked":78}}},"metricbeat":{"http":{"json":{"events":4,"failures":2,"success":2}},"sql":{"query":{"events":16,"success":16}},"system":{"cpu":{"events":3,"success":3},"filesystem":{"events":3,"success":3},"fsstat":{"events":1,"success":1},"memory":{"events":3,"success":3},"network":{"events":18,"success":18},"process":{"events":24,"success":24},"process_summary":{"events":3,"success":3},"socket_summary":{"events":3,"success":3}}}}}}

ppic · June 8, 2023, 9:50am

filebeat log file:
(I have stopped the filebeat service around 2023-06-08T08:47
and restarted it around 2023-06-08T09:07)

I have removed the similar lines, replaced with something like "(.... ~100 similar lines ....)"

C:\ProgramData\filebeat\logs\filebeat :

2023-06-08T09:07:35.270Z	INFO	instance/beat.go:685	Home path: [C:\Program Files\filebeat] Config path: [C:\Program Files\filebeat] Data path: [C:\ProgramData\filebeat] Logs path: [C:\ProgramData\filebeat\logs] Hostfs Path: [/]
2023-06-08T09:07:35.277Z	INFO	instance/beat.go:693	Beat ID: 5a9b5a47-bbef-4812-adfb-f668912fbc4a
2023-06-08T09:07:35.292Z	WARN	[add_cloud_metadata]	add_cloud_metadata/provider_aws_ec2.go:79	read token request for getting IMDSv2 token returns empty: Put "http://169.254.169.254/latest/api/token": dial tcp 169.254.169.254:80: connectex: A socket operation was attempted to an unreachable network.. No token in the metadata request will be used.
2023-06-08T09:07:35.292Z	INFO	[add_cloud_metadata]	add_cloud_metadata/add_cloud_metadata.go:101	add_cloud_metadata: hosting provider type not detected.
2023-06-08T09:07:35.292Z	INFO	[beat]	instance/beat.go:1039	Beat info	{"system_info": {"beat": {"path": {"config": "C:\\Program Files\\filebeat", "data": "C:\\ProgramData\\filebeat", "home": "C:\\Program Files\\filebeat", "logs": "C:\\ProgramData\\filebeat\\logs"}, "type": "filebeat", "uuid": "5a9b5a47-bbef-4812-adfb-f668912fbc4a"}}}
2023-06-08T09:07:35.292Z	INFO	[beat]	instance/beat.go:1048	Build info	{"system_info": {"build": {"commit": "121b2ab96f118e6999f0a4be8e98827a809337db", "libbeat": "7.17.6", "time": "2022-08-23T12:36:17.000Z", "version": "7.17.6"}}}
2023-06-08T09:07:35.292Z	INFO	[beat]	instance/beat.go:1051	Go runtime info	{"system_info": {"go": {"os":"windows","arch":"amd64","max_procs":4,"version":"go1.18.2"}}}
2023-06-08T09:07:35.300Z	INFO	[beat]	instance/beat.go:1055	Host info	{"system_info": {"host": {"architecture":"x86_64","boot_time":"2023-05-07T04:33:39Z","name":"S01223L","ip":["fe80::9184:1054:df0c:2787/64","10.229.25.26/21","10.238.116.238/26","::1/128","127.0.0.1/8","fe80::5efe:ae5:191a/128"],"kernel_version":"6.3.9600.20876 (winblue_ltsb_escrow.230301-1746)","mac":["00:50:56:01:0a:88","00:50:56:01:85:b5","00:00:00:00:00:00:00:e0","00:00:00:00:00:00:00:e0"],"os":{"type":"windows","family":"windows","platform":"windows","name":"Windows Server 2012 R2 Standard","version":"6.3","major":3,"minor":0,"patch":0,"build":"9600.19505"},"timezone":"GMT","timezone_offset_sec":0,"id":"094a2ecc-a3fd-40e3-a860-e21f3a0874ec"}}}
2023-06-08T09:07:35.300Z	INFO	[beat]	instance/beat.go:1084	Process info	{"system_info": {"process": {"cwd": "C:\\windows\\system32", "exe": "C:\\Program Files\\filebeat\\filebeat.exe", "name": "filebeat.exe", "pid": 6752, "ppid": 608, "start_time": "2023-06-08T09:07:35.111Z"}}}
2023-06-08T09:07:35.300Z	INFO	instance/beat.go:328	Setup Beat: filebeat; Version: 7.17.6
2023-06-08T09:07:35.301Z	WARN	[cfgwarn]	tlscommon/config.go:100	DEPRECATED: Treating the CommonName field on X.509 certificates as a host name when no Subject Alternative Names are present is going to be removed. Please update your certificates if needed. Will be removed in version: 8.0.0
2023-06-08T09:07:35.301Z	INFO	[esclientleg]	eslegclient/connection.go:105	elasticsearch url: https://edaas-noprod.es.elasticaas.ocb.equant.com:9243
2023-06-08T09:07:35.301Z	WARN	[tls]	tlscommon/tls_config.go:101	SSL/TLS verifications disabled.
2023-06-08T09:07:35.301Z	INFO	[publisher]	pipeline/module.go:113	Beat name: S01223L
2023-06-08T09:07:35.305Z	INFO	[monitoring]	log/log.go:142	Starting metrics logging every 30s
2023-06-08T09:07:35.305Z	INFO	kibana/client.go:180	Kibana url: https://edaas-noprod.kb.elasticaas.ocb.equant.com:9243/s/xconf-qa
2023-06-08T09:07:35.305Z	WARN	[tls]	tlscommon/tls_config.go:101	SSL/TLS verifications disabled.
2023-06-08T09:07:35.305Z	WARN	[tls]	tlscommon/tls_config.go:101	SSL/TLS verifications disabled.
2023-06-08T09:07:37.243Z	INFO	kibana/client.go:180	Kibana url: https://edaas-noprod.kb.elasticaas.ocb.equant.com:9243/s/xconf-qa
2023-06-08T09:07:37.243Z	WARN	[tls]	tlscommon/tls_config.go:101	SSL/TLS verifications disabled.
2023-06-08T09:07:37.243Z	WARN	[tls]	tlscommon/tls_config.go:101	SSL/TLS verifications disabled.
2023-06-08T09:08:05.322Z	INFO	[monitoring]	log/log.go:184	Non-zero metrics in the last 30s	{"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":250,"time":{"ms":250}},"total":{"ticks":2578,"time":{"ms":2578},"value":2578},"user":{"ticks":2328,"time":{"ms":2328}}},"handles":{"open":182},"info":{"ephemeral_id":"5e7a4647-34ed-4cb1-8d23-18bae1bb3fef","uptime":{"ms":30127},"version":"7.17.6"},"memstats":{"gc_next":64993944,"memory_alloc":60267872,"memory_sys":113265528,"memory_total":462034752,"rss":114659328},"runtime":{"goroutines":25}},"filebeat":{"harvester":{"open_files":0,"running":0}},"libbeat":{"config":{"module":{"running":0}},"output":{"events":{"active":0},"type":"elasticsearch"},"pipeline":{"clients":0,"events":{"active":0},"queue":{"max_events":4096}}},"registrar":{"states":{"current":0}},"system":{"cpu":{"cores":4}}}}}
2023-06-08T09:08:35.323Z	INFO	[monitoring]	log/log.go:184	Non-zero metrics in the last 30s	{"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":375,"time":{"ms":125}},"total":{"ticks":2843,"time":{"ms":265},"value":2843},"user":{"ticks":2468,"time":{"ms":140}}},"handles":{"open":184},"info":{"ephemeral_id":"5e7a4647-34ed-4cb1-8d23-18bae1bb3fef","uptime":{"ms":60112},"version":"7.17.6"},"memstats":{"gc_next":29736696,"memory_alloc":25427024,"memory_sys":262144,"memory_total":475496272,"rss":74428416},"runtime":{"goroutines":25}},"filebeat":{"harvester":{"open_files":0,"running":0}},"libbeat":{"config":{"module":{"running":0}},"output":{"events":{"active":0}},"pipeline":{"clients":0,"events":{"active":0}}},"registrar":{"states":{"current":0}}}}}
2023-06-08T09:09:05.324Z	INFO	[monitoring]	log/log.go:184	Non-zero metrics in the last 30s	{"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":546,"time":{"ms":171}},"total":{"ticks":3061,"time":{"ms":218},"value":3061},"user":{"ticks":2515,"time":{"ms":47}}},"handles":{"open":186},"info":{"ephemeral_id":"5e7a4647-34ed-4cb1-8d23-18bae1bb3fef","uptime":{"ms":90111},"version":"7.17.6"},"memstats":{"gc_next":25387416,"memory_alloc":19485456,"memory_total":484901456,"rss":67440640},"runtime":{"goroutines":25}},"filebeat":{"harvester":{"open_files":0,"running":0}},"libbeat":{"config":{"module":{"running":0}},"output":{"events":{"active":0}},"pipeline":{"clients":0,"events":{"active":0}}},"registrar":{"states":{"current":0}}}}}
2023-06-08T09:09:35.324Z	INFO	[monitoring]	log/log.go:184	Non-zero metrics in the last 30s	{"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":671,"time":{"ms":125}},"total":{"ticks":3249,"time":{"ms":203},"value":3249},"user":{"ticks":2578,"time":{"ms":78}}},"handles":{"open":187},"info":{"ephemeral_id":"5e7a4647-34ed-4cb1-8d23-18bae1bb3fef","uptime":{"ms":120111},"version":"7.17.6"},"memstats":{"gc_next":23977128,"memory_alloc":15041128,"memory_total":503671104,"rss":66469888},"runtime":{"goroutines":23}},"filebeat":{"harvester":{"open_files":0,"running":0}},"libbeat":{"config":{"module":{"running":0}},"output":{"events":{"active":0}},"pipeline":{"clients":0,"events":{"active":0}}},"registrar":{"states":{"current":0}}}}}
2023-06-08T09:10:05.325Z	INFO	[monitoring]	log/log.go:184	Non-zero metrics in the last 30s	{"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":812,"time":{"ms":141}},"total":{"ticks":3515,"time":{"ms":266},"value":3515},"user":{"ticks":2703,"time":{"ms":125}}},"handles":{"open":187},"info":{"ephemeral_id":"5e7a4647-34ed-4cb1-8d23-18bae1bb3fef","uptime":{"ms":150111},"version":"7.17.6"},"memstats":{"gc_next":23159128,"memory_alloc":19233496,"memory_total":518516648,"rss":65228800},"runtime":{"goroutines":23}},"filebeat":{"harvester":{"open_files":0,"running":0}},"libbeat":{"config":{"module":{"running":0}},"output":{"events":{"active":0}},"pipeline":{"clients":0,"events":{"active":0}}},"registrar":{"states":{"current":0}}}}}
2023-06-08T09:10:22.386Z	INFO	instance/beat.go:868	Kibana dashboards successfully loaded.
2023-06-08T09:10:22.386Z	INFO	instance/beat.go:492	filebeat start running.
2023-06-08T09:10:22.410Z	INFO	memlog/store.go:119	Loading data file of 'C:\ProgramData\filebeat\registry\filebeat' succeeded. Active transaction id=324892633
2023-06-08T09:10:22.644Z	INFO	memlog/store.go:124	Finished loading transaction log file for 'C:\ProgramData\filebeat\registry\filebeat'. Active transaction id=324904074
2023-06-08T09:10:22.647Z	INFO	[registrar]	registrar/registrar.go:109	States Loaded from registrar: 606
2023-06-08T09:10:22.647Z	INFO	[crawler]	beater/crawler.go:71	Loading Inputs: 1
2023-06-08T09:10:22.647Z	INFO	[crawler]	beater/crawler.go:117	starting input, keys present on the config: [filebeat.inputs.0.enabled filebeat.inputs.0.id filebeat.inputs.0.paths.0 filebeat.inputs.0.type]
2023-06-08T09:10:22.647Z	INFO	[crawler]	beater/crawler.go:121	input disabled, skipping it
2023-06-08T09:10:22.651Z	WARN	[cfgwarn]	log/input.go:89	DEPRECATED: Log input. Use Filestream input instead.
2023-06-08T09:10:22.653Z	INFO	[input]	log/input.go:171	Configured paths: [C:\inetpub\logs\LogFiles\*\*.log]	{"input_id": "9ce63cd6-eb7d-4c68-bee5-4089a06cb1dd"}
2023-06-08T09:10:22.654Z	INFO	[input]	log/input.go:171	Configured paths: [C:\Windows\System32\LogFiles\HTTPERR\*.log]	{"input_id": "d82bdfd1-c933-4c27-ae6a-0ead86242b63"}
2023-06-08T09:10:22.654Z	INFO	[crawler]	beater/crawler.go:106	Loading and starting Inputs completed. Enabled inputs: 0
2023-06-08T09:10:22.654Z	INFO	cfgfile/reload.go:164	Config reloader started
2023-06-08T09:10:29.789Z	INFO	[input]	log/input.go:171	Configured paths: [C:\inetpub\logs\LogFiles\*\*.log]	{"input_id": "cfb13582-b88a-4f27-be45-efa5c6cf818f"}
2023-06-08T09:10:29.844Z	INFO	[input]	log/input.go:171	Configured paths: [C:\Windows\System32\LogFiles\HTTPERR\*.log]	{"input_id": "02a11503-eac9-4169-82e4-d1ab3f6d8015"}
2023-06-08T09:10:29.844Z	INFO	[esclientleg]	eslegclient/connection.go:105	elasticsearch url: https://edaas-noprod.es.elasticaas.ocb.equant.com:9243
2023-06-08T09:10:29.844Z	WARN	[tls]	tlscommon/tls_config.go:101	SSL/TLS verifications disabled.
2023-06-08T09:10:29.844Z	WARN	[tls]	tlscommon/tls_config.go:101	SSL/TLS verifications disabled.
2023-06-08T09:10:33.571Z	INFO	[esclientleg]	eslegclient/connection.go:285	Attempting to connect to Elasticsearch version 7.17.1
2023-06-08T09:10:33.659Z	INFO	[modules]	fileset/pipelines.go:133	Elasticsearch pipeline loaded.	{"pipeline": "filebeat-7.17.6-iis-access-pipeline"}
2023-06-08T09:10:33.686Z	INFO	[modules]	fileset/pipelines.go:133	Elasticsearch pipeline loaded.	{"pipeline": "filebeat-7.17.6-iis-error-pipeline"}
2023-06-08T09:10:33.704Z	INFO	cfgfile/reload.go:224	Loading of config files completed.
2023-06-08T09:10:33.754Z	INFO	[input.harvester]	log/harvester.go:309	Harvester started for paths: [C:/inetpub/logs/LogFiles/*/*.log]	{"input_id": "cfb13582-b88a-4f27-be45-efa5c6cf818f", "source": "C:\\inetpub\\logs\\LogFiles\\W3SVC2\\u_ex230608.log", "state_id": "native::13369344-251911-916654257", "finished": false, "os_id": "13369344-251911-916654257", "old_source": "C:\\inetpub\\logs\\LogFiles\\W3SVC2\\u_ex230608.log", "old_finished": true, "old_os_id": "13369344-251911-916654257", "harvester_id": "48a39f41-0029-49d5-ad4c-40cbeb739de3"}
2023-06-08T09:10:33.777Z	INFO	[input.harvester]	log/harvester.go:309	Harvester started for paths: [C:/inetpub/logs/LogFiles/*/*.log]	{"input_id": "cfb13582-b88a-4f27-be45-efa5c6cf818f", "source": "C:\\inetpub\\logs\\LogFiles\\W3SVC1\\u_ex2306_x.log", "state_id": "native::71368704-39649-916654257", "finished": false, "os_id": "71368704-39649-916654257", "old_source": "C:\\inetpub\\logs\\LogFiles\\W3SVC1\\u_ex2306_x.log", "old_finished": true, "old_os_id": "71368704-39649-916654257", "harvester_id": "750397ac-e488-4aa2-b2d7-9767cea09273"}
2023-06-08T09:10:34.769Z	INFO	[publisher_pipeline_output]	pipeline/output.go:143	Connecting to backoff(elasticsearch(https://edaas-noprod.es.elasticaas.ocb.equant.com:9243))
2023-06-08T09:10:34.769Z	INFO	[publisher]	pipeline/retry.go:219	retryer: send unwait signal to consumer
2023-06-08T09:10:34.769Z	INFO	[publisher]	pipeline/retry.go:223	  done
2023-06-08T09:10:34.769Z	WARN	[tls]	tlscommon/tls_config.go:101	SSL/TLS verifications disabled.
2023-06-08T09:10:34.792Z	INFO	[esclientleg]	eslegclient/connection.go:285	Attempting to connect to Elasticsearch version 7.17.1
2023-06-08T09:10:34.815Z	INFO	[esclientleg]	eslegclient/connection.go:285	Attempting to connect to Elasticsearch version 7.17.1
2023-06-08T09:10:34.827Z	INFO	[modules]	fileset/pipelines.go:133	Elasticsearch pipeline loaded.	{"pipeline": "filebeat-7.17.6-iis-error-pipeline"}
2023-06-08T09:10:34.845Z	INFO	[modules]	fileset/pipelines.go:133	Elasticsearch pipeline loaded.	{"pipeline": "filebeat-7.17.6-iis-access-pipeline"}
2023-06-08T09:10:34.845Z	INFO	[publisher_pipeline_output]	pipeline/output.go:151	Connection to backoff(elasticsearch(https://edaas-noprod.es.elasticaas.ocb.equant.com:9243)) established
2023-06-08T09:10:35.327Z	INFO	[monitoring]	log/log.go:184	Non-zero metrics in the last 30s	{"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":2468,"time":{"ms":1656}},"total":{"ticks":12577,"time":{"ms":9047},"value":12577},"user":{"ticks":10109,"time":{"ms":7391}}},"handles":{"open":194},"info":{"ephemeral_id":"5e7a4647-34ed-4cb1-8d23-18bae1bb3fef","uptime":{"ms":180129},"version":"7.17.6"},"memstats":{"gc_next":30930424,"memory_alloc":15828160,"memory_sys":262144,"memory_total":1774812264,"rss":71110656},"runtime":{"goroutines":56}},"filebeat":{"events":{"active":213,"added":1271,"done":1058},"harvester":{"open_files":2,"running":2,"started":2}},"libbeat":{"config":{"module":{"running":1,"starts":1},"reloads":1,"scans":1},"output":{"events":{"acked":450,"active":50,"batches":10,"total":500},"read":{"bytes":14930},"write":{"bytes":667092}},"pipeline":{"clients":2,"events":{"active":213,"filtered":608,"published":663,"retry":50,"total":1271},"queue":{"acked":450}}},"registrar":{"states":{"current":606,"update":1108},"writes":{"success":616,"total":617}}}}}
2023-06-08T09:11:05.327Z	INFO	[monitoring]	log/log.go:184	Non-zero metrics in the last 30s	{"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":2703,"time":{"ms":250}},"total":{"ticks":13046,"time":{"ms":484},"value":13046},"user":{"ticks":10343,"time":{"ms":234}}},"handles":{"open":194},"info":{"ephemeral_id":"5e7a4647-34ed-4cb1-8d23-18bae1bb3fef","uptime":{"ms":210111},"version":"7.17.6"},"memstats":{"gc_next":24510712,"memory_alloc":20486392,"memory_total":1803201136,"rss":67346432},"runtime":{"goroutines":55}},"filebeat":{"events":{"active":-213,"done":213},"harvester":{"open_files":2,"running":2}},"libbeat":{"config":{"module":{"running":1}},"output":{"events":{"acked":213,"active":0,"batches":4,"total":163},"read":{"bytes":4193},"write":{"bytes":211405}},"pipeline":{"clients":2,"events":{"active":0},"queue":{"acked":213}}},"registrar":{"states":{"current":606,"update":163},"writes":{"success":5,"total":4}}}}}
2023-06-08T09:11:35.327Z	INFO	[monitoring]	log/log.go:184	Non-zero metrics in the last 30s	{"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":3000,"time":{"ms":282}},"total":{"ticks":13531,"time":{"ms":470},"value":13531},"user":{"ticks":10531,"time":{"ms":188}}},"handles":{"open":193},"info":{"ephemeral_id":"5e7a4647-34ed-4cb1-8d23-18bae1bb3fef","uptime":{"ms":240112},"version":"7.17.6"},"memstats":{"gc_next":24199672,"memory_alloc":14228520,"memory_total":1827868032,"rss":67825664},"runtime":{"goroutines":53}},"filebeat":{"events":{"added":21,"done":21},"harvester":{"open_files":2,"running":2}},"libbeat":{"config":{"module":{"running":1}},"output":{"events":{"acked":21,"active":0,"batches":3,"total":21},"read":{"bytes":1841},"write":{"bytes":27646}},"pipeline":{"clients":2,"events":{"active":0,"published":21,"total":21},"queue":{"acked":21}}},"registrar":{"states":{"current":606,"update":21},"writes":{"success":3,"total":3}}}}}
2023-06-08T09:12:05.328Z	INFO	[monitoring]	log/log.go:184	Non-zero metrics in the last 30s	{"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":3218,"time":{"ms":234}},"total":{"ticks":13843,"time":{"ms":328},"value":13843},"user":{"ticks":10625,"time":{"ms":94}}},"handles":{"open":191},"info":{"ephemeral_id":"5e7a4647-34ed-4cb1-8d23-18bae1bb3fef","uptime":{"ms":270112},"version":"7.17.6"},"memstats":{"gc_next":23959032,"memory_alloc":11913984,"memory_total":1845595032,"rss":67883008},"runtime":{"goroutines":51}},"filebeat":{"harvester":{"open_files":2,"running":2}},"libbeat":{"config":{"module":{"running":1}},"output":{"events":{"active":0}},"pipeline":{"clients":2,"events":{"active":0}}},"registrar":{"states":{"current":606}}}}}
2023-06-08T09:12:35.330Z	INFO	[monitoring]	log/log.go:184	Non-zero metrics in the last 30s	{"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":3500,"time":{"ms":266}},"total":{"ticks":14218,"time":{"ms":359},"value":14218},"user":{"ticks":10718,"time":{"ms":93}}},"handles":{"open":191},"info":{"ephemeral_id":"5e7a4647-34ed-4cb1-8d23-18bae1bb3fef","uptime":{"ms":300112},"version":"7.17.6"},"memstats":{"gc_next":24121624,"memory_alloc":22781336,"memory_total":1868238816,"rss":68247552},"runtime":{"goroutines":52}},"filebeat":{"events":{"active":8,"added":22,"done":14},"harvester":{"open_files":2,"running":2}},"libbeat":{"config":{"module":{"running":1}},"output":{"events":{"acked":14,"active":8,"batches":3,"total":22},"read":{"bytes":1226},"write":{"bytes":28957}},"pipeline":{"clients":2,"events":{"active":8,"published":22,"total":22},"queue":{"acked":14}}},"registrar":{"states":{"current":606,"update":14},"writes":{"success":2,"total":2}}}}}
2023-06-08T09:13:05.328Z	INFO	[monitoring]	log/log.go:184	Non-zero metrics in the last 30s	{"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":3625,"time":{"ms":125}},"total":{"ticks":14437,"time":{"ms":219},"value":14437},"user":{"ticks":10812,"time":{"ms":94}}},"handles":{"open":191},"info":{"ephemeral_id":"5e7a4647-34ed-4cb1-8d23-18bae1bb3fef","uptime":{"ms":330119},"version":"7.17.6"},"memstats":{"gc_next":23973768,"memory_alloc":13184544,"memory_total":1882318552,"rss":68390912},"runtime":{"goroutines":51}},"filebeat":{"events":{"active":-8,"done":8},"harvester":{"open_files":2,"running":2}},"libbeat":{"config":{"module":{"running":1}},"output":{"events":{"acked":8,"active":0},"read":{"bytes":628}},"pipeline":{"clients":2,"events":{"active":0},"queue":{"acked":8}}},"registrar":{"states":{"current":606,"update":8},"writes":{"success":1,"total":1}}}}}
2023-06-08T09:13:35.331Z	INFO	[monitoring]	log/log.go:184	Non-zero metrics in the last 30s	{"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":3906,"time":{"ms":281}},"total":{"ticks":14921,"time":{"ms":484},"value":14921},"user":{"ticks":11015,"time":{"ms":203}}},"handles":{"open":193},"info":{"ephemeral_id":"5e7a4647-34ed-4cb1-8d23-18bae1bb3fef","uptime":{"ms":360128},"version":"7.17.6"},"memstats":{"gc_next":24172472,"memory_alloc":14639984,"memory_total":1907001640,"rss":68411392},"runtime":{"goroutines":51}},"filebeat":{"events":{"added":21,"done":21},"harvester":{"open_files":2,"running":2}},"libbeat":{"config":{"module":{"running":1}},"output":{"events":{"acked":21,"active":0,"batches":3,"total":21},"read":{"bytes":1846},"write":{"bytes":27788}},"pipeline":{"clients":2,"events":{"active":0,"published":21,"total":21},"queue":{"acked":21}}},"registrar":{"states":{"current":606,"update":21},"writes":{"success":3,"total":3}}}}}
2023-06-08T09:14:05.331Z	INFO	[monitoring]	log/log.go:184	Non-zero metrics in the last 30s	{"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":4187,"time":{"ms":281}},"total":{"ticks":15249,"time":{"ms":328},"value":15249},"user":{"ticks":11062,"time":{"ms":47}}},"handles":{"open":193},"info":{"ephemeral_id":"5e7a4647-34ed-4cb1-8d23-18bae1bb3fef","uptime":{"ms":390111},"version":"7.17.6"},"memstats":{"gc_next":24456568,"memory_alloc":20460928,"memory_total":1924723752,"rss":68415488},"runtime":{"goroutines":51}},"filebeat":{"harvester":{"open_files":2,"running":2}},"libbeat":{"config":{"module":{"running":1}},"output":{"events":{"active":0}},"pipeline":{"clients":2,"events":{"active":0}}},"registrar":{"states":{"current":606}}}}}
2023-06-08T09:14:35.332Z	INFO	[monitoring]	log/log.go:184	Non-zero metrics in the last 30s	{"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":4484,"time":{"ms":297}},"total":{"ticks":15624,"time":{"ms":375},"value":15624},"user":{"ticks":11140,"time":{"ms":78}}},"handles":{"open":193},"info":{"ephemeral_id":"5e7a4647-34ed-4cb1-8d23-18bae1bb3fef","uptime":{"ms":420127},"version":"7.17.6"},"memstats":{"gc_next":24311528,"memory_alloc":21594296,"memory_total":1949400840,"rss":69218304},"runtime":{"goroutines":51}},"filebeat":{"events":{"added":27,"done":27},"harvester":{"open_files":2,"running":2}},"libbeat":{"config":{"module":{"running":1}},"output":{"events":{"acked":27,"active":0,"batches":3,"total":27},"read":{"bytes":1875},"write":{"bytes":34792}},"pipeline":{"clients":2,"events":{"active":0,"published":27,"total":27},"queue":{"acked":27}}},"registrar":{"states":{"current":606,"update":27},"writes":{"success":3,"total":3}}}}}
2023-06-08T09:15:05.333Z	INFO	[monitoring]	log/log.go:184	Non-zero metrics in the last 30s	{"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":4734,"time":{"ms":250}},"total":{"ticks":15999,"time":{"ms":375},"value":15999},"user":{"ticks":11265,"time":{"ms":125}}},"handles":{"open":193},"info":{"ephemeral_id":"5e7a4647-34ed-4cb1-8d23-18bae1bb3fef","uptime":{"ms":450112},"version":"7.17.6"},"memstats":{"gc_next":24216312,"memory_alloc":15416152,"memory_total":1967168080,"rss":69222400},"runtime":{"goroutines":51}},"filebeat":{"harvester":{"open_files":2,"running":2}},"libbeat":{"config":{"module":{"running":1}},"output":{"events":{"active":0}},"pipeline":{"clients":2,"events":{"active":0}}},"registrar":{"states":{"current":606}}}}}

Hope it can help.
Best rgds.

system · July 6, 2023, 9:51am

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.

Topic		Replies	Views
Help with elesticsearch and metricbeat Beats elastic-stack-monitoring , docker , beats-module , metricbeat	3	402	July 21, 2021
Filebeat Modules: No results found in Kibana Elasticsearch beats-module	1	479	January 17, 2020
Metricbeat Kibana dashboard not loading Beats metricbeat	9	1288	May 21, 2020
Metricbeat does not start service Beats metricbeat	19	8555	June 2, 2020
Cant see data from Windows module in kibana Beats metricbeat	4	918	June 30, 2020

Stopping filebeats affects metricbeat http module

Related Topics