From 50b77f98c389e2cb2de665c1fba4a8a1e4652757 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?No=C3=A9mi=20V=C3=A1nyi?= Date: Tue, 22 Jun 2021 14:54:50 +0200 Subject: [PATCH 1/2] Decrease log level from error to debug when closing file inf filestream input with close_* options --- filebeat/input/filestream/filestream.go | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/filebeat/input/filestream/filestream.go b/filebeat/input/filestream/filestream.go index 908d8558145..5e72dc927b9 100644 --- a/filebeat/input/filestream/filestream.go +++ b/filebeat/input/filestream/filestream.go @@ -179,14 +179,21 @@ func (f *logFile) shouldBeClosed() bool { info, statErr := f.file.Stat() if statErr != nil { + // return early if the file does not exist anymore and the reader should be closed + if f.closeRemoved && errors.Is(statErr, os.ErrNotExist) { + f.log.Debugf("close.on_state_change.removed is enabled and file %s has been removed", f.file.Name()) + return true + } + + // If an unexpected error happens we keep the reader open hoping once everything will go back to normal. f.log.Errorf("Unexpected error reading from %s; error: %s", f.file.Name(), statErr) - return true + return false } if f.closeRenamed { // Check if the file can still be found under the same path if !isSameFile(f.file.Name(), info) { - f.log.Debugf("close_renamed is enabled and file %s has been renamed", f.file.Name()) + f.log.Debugf("close.on_state_change.renamed is enabled and file %s has been renamed", f.file.Name()) return true } } @@ -194,7 +201,7 @@ func (f *logFile) shouldBeClosed() bool { if f.closeRemoved { // Check if the file name exists. See https://github.com/elastic/filebeat/issues/93 if file.IsRemoved(f.file) { - f.log.Debugf("close_removed is enabled and file %s has been removed", f.file.Name()) + f.log.Debugf("close.on_state_change.removed is enabled and file %s has been removed", f.file.Name()) return true } } From 8ab0707220867ae4a80298fc583883e8d625caa9 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?No=C3=A9mi=20V=C3=A1nyi?= Date: Tue, 22 Jun 2021 17:09:00 +0200 Subject: [PATCH 2/2] add changelog entry --- CHANGELOG.next.asciidoc | 1 + 1 file changed, 1 insertion(+) diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc index 220cd1c03d9..7cc03a0d061 100644 --- a/CHANGELOG.next.asciidoc +++ b/CHANGELOG.next.asciidoc @@ -276,6 +276,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d - Fix default config template values for paths on oracle module: {pull}26276[26276] - Fix bug in aws-s3 input where the end of gzipped log files might have been discarded. {pull}26260[26260] - Fix bug in `httpjson` that prevented `first_event` getting updated. {pull}26407[26407] +- Do not close filestream harvester if an unexpected error is returned when close.on_state_change.* is enabled. {pull}26411[26411] *Filebeat*