search

elastic / beats

:tropical_fish: Beats - Lightweight shippers for Elasticsearch & Logstash
https://www.elastic.co/products/beats
Other
103 stars 4.92k forks source link

[filebeat]How to fix the case? Frequently occurring “should have been dropped, but couldn’t as state is not finished” #35902

Open micmeow opened 1 year ago

micmeow commented 1 year ago

Hello. If you know how fix that, lend me your wisdom. How to fix the case?

I use filebeat to transfer logs to Logstash to Opensearch. When I checked the filebeat log, I found that the same log file transfer errors were occurring frequently.

I counldn't know the cause, so I tried to reproduce it in the verification environment, but it didn't succeed.

I would like to know if there is a way to improve it. I've considered restarting the filebeat process, but I'd like to be careful when doing so in the production environment. So, I would like to know how a way except restarting the process.

Varsion: Filebeat 7.10.0

filebeat log：

2023-02-15T20:00:01.225+0900    ERROR   file/states.go:125      State for /home/XXXX/XXXX/log/log.SAMPLE.BASH.20221030204209 should have been dropped, but couldn't as state is not finished.
2023-02-15T20:00:04.346+0900    ERROR   file/states.go:125      State for /home/XXXX/XXXX/log/log.SAMPLE.BASH.20221030204209 should have been dropped, but couldn't as state is not finished.
2023-02-15T20:00:08.834+0900    ERROR   file/states.go:125      State for /home/XXXX/XXXX/log/log.SAMPLE.BASH.20221030204209 should have been dropped, but couldn't as state is not finished.
2023-02-15T20:00:08.919+0900    ERROR   file/states.go:125      State for /home/XXXX/XXXX/log/log.SAMPLE.BASH.20221030204209 should have been dropped, but couldn't as state is not finished.
2023-02-15T20:00:13.191+0900    ERROR   file/states.go:125      State for /home/XXXX/XXXX/log/log.SAMPLE.BASH.20221030204209 should have been dropped, but couldn't as state is not finished.

Thank you!

### Tasks
- [ ] filebeat
botelastic[bot] commented 1 year ago

This issue doesn't have a Team:<team> label.

ycyin commented 7 months ago

Same issue. Filebeat:7.13.4 in k8s.

2024-04-07T09:15:48.366Z        ERROR   file/states.go:125      State for /opt/applog/xxx/xxx-release-b-6ff45ff9fc-sxpn2/logs.json should have been dropped, but couldn't as state is not finished.
2024-04-07T09:15:48.945Z        ERROR   file/states.go:125      State for /opt/applog/xxx/xxx-release-b-6ff45ff9fc-sxpn2/logs.json should have been dropped, but couldn't as state is not finished.