Unable to stop filebeat


I am unable to stop filebeat from sending the logs
My filebeat config is


  • input_type: log
    • /var/www/html/hfurpublic_html/urllog/**/*
      service_id: 347rfnkr
      pattern: '^{"+\w[a-z]'
      negate: true
      match: before
      hosts: ['IP:5044']

As i run the filebeat with the command ./filebeat & after that when i kill it with PID
even after killing I am still getting logs in the index moreover I have also shut down logstash.
even i checked it with the grep command
both logstash and filebeat are not working still i am getting logs

A help would be really appreciated


@elastic Please someone help if possible
a guidence is needed


Are you sure you don't have other Filebeat and/or Logstash processes running, perhaps in the background and/or on another machine?

@shaunak Thankyou for the response.
I installed two beats as i want to index the data to two different indices at different cluster.
So i installed two different beats and started them in background

I killed both the apps still i am getting the data.
and even after killing the logstash
even i checked PID


I'm not sure what OS you are on but if you are on a Unix-y OS, can you run netstat -an to see what connections are being made to your Elasticsearch host (even after stopping all Logstash and Filebeat processes)?

I am on linux.
Dont know why it is so
I closed my filebeat at 1pm
and still passing the logs

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.