Writing of registry returned error:

Elastic Stack Beats
1

Hi,

I get the following error constantly no matter what I do:
Writing of registry returned error: rename /var/lib/filebeat/registry/filebeat/data.json.new /var/lib/filebeat/registry/filebeat/data.json: no such file or directory. Continuing...

Permissions set:

drwxrwxrwx 2 root root 4.0K Jan 27 12:49 filebeat

-rw------- 1 root root 1.5K Jan 27 12:49 data.json
-rwxrwxrwx 1 root root   16 Nov 27 22:00 meta.json

I change the permissions on data.json but when filebeat runs, it changed the permissions back to above......
Hope somebody knows a solution for this.

2

Hey,

how do you run Filebeat? Could you provide the command you use and as which user you run it?

Also please check this similar topic that may be helpful.

C.

3

Hi,

I run Filebeat with: systemctl start filebeat

These are the permissions in var/lib/filebeat/registry/filebeat/
drwxrwxrwx 2 root root 4.0K Jan 27 14:09 .
drwxrwxrwx 3 root root 4.0K Nov 27 22:00 ..
-rw------- 1 root root 1.5K Jan 27 14:09 data.json
-rwxrwxrwx 1 root root 16 Nov 27 22:00 meta.json

So unfortunately that other topic doesn't work for me.

4

Hi!

Since you run it as system service you most probably need to start it as root. I was not able to reproduce your issue on my end. Here is what I see:

ubuntu@ip-xxxxx:~$ sudo ls -la /var/lib/filebeat/registry/filebeat
total 16
drwxr-x--- 2 root root 4096 Jan 28 09:10 .
drwxr-x--- 3 root root 4096 Jan 28 09:10 ..
-rw------- 1 root root    3 Jan 28 09:10 data.json
-rw------- 1 root root   16 Jan 28 09:10 meta.json

ubuntu@ip-xxxxxx:~$ sudo systemctl status filebeat
● filebeat.service - Filebeat sends log files to Logstash or directly to Elasticsearch.
   Loaded: loaded (/lib/systemd/system/filebeat.service; enabled; vendor preset: enabled)
   Active: active (running) since Tue 2020-01-28 09:10:39 UTC; 7min ago
     Docs: https://www.elastic.co/products/beats/filebeat
 Main PID: 2522 (filebeat)
    Tasks: 8 (limit: 1152)
   CGroup: /system.slice/filebeat.service
           └─2522 /usr/share/filebeat/bin/filebeat -e -c /etc/filebeat/filebeat.yml -path.home /usr/share/filebeat -path.config /etc/filebeat -path.data /var/lib/filebeat -path.logs /var/log/filebeat

Jan 28 09:13:09 ip-172-31-45-67 filebeat[2522]: 2020-01-28T09:13:09.250Z        INFO        [monitoring]        log/log.go:145        Non-zero metrics in the last 30s       ...
Jan 28 09:13:39 ip-172-31-45-67 filebeat[2522]: 2020-01-28T09:13:39.250Z        INFO        [monitoring]        log/log.go:145        Non-zero metrics in the last 30s      ....

And I manage the service with sudo as I mentioned, like sudo systemctl start filebeat. https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-starting.html#filebeat-starting

C.

5

Hi,

Thanks for your repsonse!
I tried what you said but it doens't fix it. (I was already doing everything as root)

Hope you have more ideas to try.