search

elastic / beats

:tropical_fish: Beats - Lightweight shippers for Elasticsearch & Logstash
https://www.elastic.co/products/beats
Other
97 stars 4.92k forks source link

Add Filebeat registry to the diagnostics bundle for the control V2 protocol #33238

Open rdner opened 2 years ago

rdner commented 2 years ago

Describe the enhancement:

It's possible to register a hook in the control protocol V2 so when the agent requests diagnostics from Filebeat it could send some data useful for debugging back to the agent. This should include the Filebeat registry as well.

Describe a specific use case for the enhancement or feature:

We had a few SDHs that were related to the changed inode value of the input file with the same filename. Filebeat gets confused and can ingest lines multiple times. This might happen due to a log rotation strategy or using a network share as a source filesystem. To diagnose this, we need to scan through the registry log file log.json. It can be done, for example, with this tool.

elasticmachine commented 2 years ago

Pinging @elastic/elastic-agent-data-plane (Team:Elastic-Agent-Data-Plane)