Wavefront proxy LogsIngester not establish response to Filebeat after 1 hour idle

Elastic Stack Beats
1

We found that log metric cannot send wavefront if the log file has been idle for ~1 hour.

Filebeat version 6.3.2 (amd64), libbeat 6.3.2

Attached filebeat.yml and logsIngestion.yaml

Steps to reproduce:

  1. Write log to file:
    echo -ne "[INFO]xxxyyy\ncom.now.ottid.api.controllers.HomeController\n### Connected database successfully asdf" >> /tmp/logs.txt

  2. Wait ~1 hour, will get below result on wavefront

  3. After the point stopped, write log to file again:
    echo -ne "[INFO]xxxyyy\ncom.now.ottid.api.controllers.HomeController\n### Connected database successfully asdf" >> /tmp/logs.txt
    Problem: The log will not show on wavefront

Filebeat log:

Wavefront proxy log:

Already try to restart filebeat, dose not help.

  1. Write log to file, but different text:
    echo -ne "[INFO]xxxyyy\ncom.now.ottid.api.controllers.HomeController\n### Connected database successfully" >> /tmp/logs.txt

The log will show on wavefront:

  1. Write the previous log to file, still not show on wavefront.
    echo -ne "[INFO]xxxyyy\ncom.now.ottid.api.controllers.HomeController\n### Connected database successfully asdf" >> /tmp/logs.txt

  2. After restart wavefront proxy, wavefront can receive the log again
    echo -ne "[INFO]xxxyyy\ncom.now.ottid.api.controllers.HomeController\n### Connected database successfully asdf" >> /tmp/logs.txt[FileBeat Logs](http://FileBeat Logs)

===============================================================
yml configuration

filebeat.inputs:

  • type: log
    paths:
    • /tmp/logs.txt
      multiline.pattern: '^['
      multiline.negate: true
      multiline.match: after
      harvester_limit: 0
      fields:
      close_inactive: 2h
      clean_inactive: 25h

output:
logstash:
hosts: ["localhost:5044"]

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.