{"id":9322,"date":"2022-09-15T16:10:25","date_gmt":"2022-09-15T21:10:25","guid":{"rendered":"https:\/\/www.rushworth.us\/lisa\/?p=9322"},"modified":"2022-09-15T16:10:25","modified_gmt":"2022-09-15T21:10:25","slug":"filebeat-no-harvesters-starting","status":"publish","type":"post","link":"https:\/\/www.rushworth.us\/lisa\/?p=9322","title":{"rendered":"Filebeat &#8211; No Harvesters Starting"},"content":{"rendered":"<p>Using filebeat-7.17.4, we have seen instances where no harvesters will start and no IP communication is established with the logstash servers. Stopping the filebeat service, confirming the process and any associated network ports are closed, and then starting the service does not restore communication. In this situation, we have had to restart the <em>\u200blogstash<\/em>\u200b servers and immediately begin to see harvesters spin up in the log files:<\/p>\n<pre>2022-09-15T12:02:20.018-0400\u00a0\u00a0\u00a0 INFO\u00a0\u00a0\u00a0 [input.harvester]\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 log\/harvester.go:309\u00a0\u00a0\u00a0 Harvester started for paths: \r\n[\/var\/log\/network\/network.log \/opt\/splunk\/var\/log\/syslog-ng\/*\/*.log]\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \r\n{\"input_id\": \"bf04e307-7fb3-5555-87d5-55555d3fa8d6\", \"source\": \"\/var\/log\/syslog-ng\/<a href=\"http:\/\/mr01.example.net\/network.log\">mr01.example.net\/network.log<\/a>\",\r\n \"state_id\": \"native::2228458-65570\", \"finished\": false, \"os_id\": \"2225548-64550\", \"old_source\": \r\n\"\/var\/log\/syslog-ng\/<a href=\"http:\/\/mr01.example.net\/network.log\">mr01.example.net\/network.log<\/a>\", \"old_finished\": true, \"old_os_id\": \"2225548-64550\", \r\n\"harvester_id\": \"36555c83-455c-4551-9f55-dd5555552771\"}\r\n\r\n<\/pre>\n","protected":false},"excerpt":{"rendered":"<p>Using filebeat-7.17.4, we have seen instances where no harvesters will start and no IP communication is established with the logstash servers. Stopping the filebeat service, confirming the process and any associated network ports are closed, and then starting the service does not restore communication. In this situation, we have had to restart the \u200blogstash\u200b servers &hellip;<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1588],"tags":[1589,1643],"class_list":["post-9322","post","type-post","status-publish","format-standard","hentry","category-elk","tag-elk","tag-logstash"],"_links":{"self":[{"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=\/wp\/v2\/posts\/9322","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=9322"}],"version-history":[{"count":1,"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=\/wp\/v2\/posts\/9322\/revisions"}],"predecessor-version":[{"id":9330,"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=\/wp\/v2\/posts\/9322\/revisions\/9330"}],"wp:attachment":[{"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=9322"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=9322"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=9322"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}