2

I use filebeat with elk. I started it with nohup command. nohup ./filebeat -e -c filebeat.yml -d "publish" > filebeat.log & Application stopped automatically after one day. close_inactive parameter is not work. Is there any configuration that i missed for this problem.

2020-10-22T09:55:36.814+0100    INFO    crawler/crawler.go:165  Crawler stopped
2020-10-22T09:55:36.815+0100    INFO    registrar/registrar.go:367      Stopping Registrar
2020-10-22T09:55:36.815+0100    INFO    registrar/registrar.go:293      Ending Registrar
2020-10-22T09:55:36.820+0100    INFO    [monitoring]    log/log.go:153  Total non-zero metrics  {"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":10540,"time":{"ms":10547}},"total":{"ticks":68190,"time":{"ms":68203},"value":68190},"user":{"ticks":57650,"time":{"ms":57656}}},"handles":{"limit":{"hard":16000,"soft":16000},"open":10},"info":{"ephemeral_id":"b57f1c4d-7a80-4f1f-aaba-5ab9ee057757","uptime":{"ms":7119571}},"memstats":{"gc_next":22377264,"memory_alloc":11462592,"memory_total":18240359416,"rss":50831360},"runtime":{"goroutines":21}},"filebeat":{"events":{"added":528063,"done":528063},"harvester":{"closed":77,"open_files":0,"running":0,"started":77},"input":{"log":{"files":{"truncated":38}}}},"libbeat":{"config":{"module":{"running":0},"reloads":1},"output":{"events":{"acked":527884,"batches":4732,"failed":51426,"total":579310},"read":{"bytes":32364,"errors":4},"type":"logstash","write":{"bytes":180629879,"errors":19}},"pipeline":{"clients":0,"events":{"active":0,"filtered":179,"published":527884,"retry":99719,"total":528063},"queue":{"acked":527884}}},"registrar":{"states":{"cleanup":8,"current":38,"update":528063},"writes":{"success":4356,"total":4356}},"system":{"cpu":{"cores":8},"load":{"1":0.66,"15":0.52,"5":0.56,"norm":{"1":0.0825,"15":0.065,"5":0.07}}}}}}
2020-10-22T09:55:36.820+0100    INFO    [monitoring]    log/log.go:154  Uptime: 1h58m39.572210325s
2020-10-22T09:55:36.820+0100    INFO    [monitoring]    log/log.go:131  Stopping metrics logging.
2020-10-22T09:55:36.820+0100    INFO    instance/beat.go:432    filebeat stopped.
Turker Ozturk
  • 46
  • 5

2 Answers2

0

What is the content of "filebeat.yml"? it can stop for example if you didn't define any paths.

Also, you might want to change the logging level to get more information as to what happened:

logging.level: debug
abregman
  • 44
  • 4
0

Stop the filebeat service and Run the Filebeat in debug mode from command line to check for any issue in your configuration using the command below from the filebeat home directory.

filebeat -e -c filebeat.yml -d "*"
Ankit
  • 599
  • 2
  • 11