Unable to stop filebeat

Elastic Stack Beats
1

Hello,

I am unable to stop filebeat from sending the logs
My filebeat config is

filebeat.prospectors:

  • input_type: log
    paths:
    • /var/www/html/hfurpublic_html/urllog/**/*
      fields:
      service_id: 347rfnkr
      multiline:
      pattern: '^{"+\w[a-z]'
      negate: true
      match: before
      output.logstash:
      hosts: ['IP:5044']

As i run the filebeat with the command ./filebeat & after that when i kill it with PID
even after killing I am still getting logs in the index moreover I have also shut down logstash.
even i checked it with the grep command
both logstash and filebeat are not working still i am getting logs

A help would be really appreciated

Regards

2

@elastic Please someone help if possible
a guidence is needed

Regards

3

Are you sure you don't have other Filebeat and/or Logstash processes running, perhaps in the background and/or on another machine?

4

@shaunak Thankyou for the response.
I installed two beats as i want to index the data to two different indices at different cluster.
So i installed two different beats and started them in background

I killed both the apps still i am getting the data.
and even after killing the logstash
even i checked PID

Regards

5

I'm not sure what OS you are on but if you are on a Unix-y OS, can you run netstat -an to see what connections are being made to your Elasticsearch host (even after stopping all Logstash and Filebeat processes)?

6

I am on linux.
Dont know why it is so
I closed my filebeat at 1pm
and still passing the logs

7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.