Hi, we noticed that the license expiration will have an averse effect on filebeat log ingestion.
In our case, our trial license expired, breaking filebeat log ingestion and spiking CPU on our log shipping servers.
Altough the documentation mentions filebeat should continue working on license expiration.
Relevant logs from filebeat:
Sep 16 08:41:21 xxx filebeat[2385955]: 2020-09-16T08:41:21.395+0200 INFO [esclientleg] eslegclient/connection.go:314 Attempting to connect to Elasticsearch version 7.8.1
Sep 16 08:41:25 xxx filebeat[2385955]: 2020-09-16T08:41:25.851+0200 ERROR [publisher_pipeline_output] pipeline/output.go:155 Failed to connect to backoff(elasticsearch(https://127.0.0.1:9200)): Connection marked as failed because the onConnect callback failed: cannot retrieve the elasticsearch license from the /_license endpoint, Filebeat requires the default distribution of Elasticsearch. Please make the endpoint accessible to Filebeat so it can verify the license.: could not extract license information from the server response: unknown state, received: 'expired'
Sep 16 08:41:25 xxx filebeat[2385955]: 2020-09-16T08:41:25.851+0200 INFO [publisher_pipeline_output] pipeline/output.go:146 Attempting to reconnect to backoff(elasticsearch(https://127.0.0.1:9200)) with >
Sep 16 08:41:25 xxx filebeat[2385955]: 2020-09-16T08:41:25.851+0200 INFO [publisher] pipeline/retry.go:221 retryer: send unwait signal to consumer
Sep 16 08:41:25 xxx filebeat[2385955]: 2020-09-16T08:41:25.851+0200 INFO [publisher] pipeline/retry.go:225 done
Sep 16 08:41:25 xxx filebeat[2385955]: 2020-09-16T08:41:25.854+0200 INFO [esclientleg] eslegclient/connection.go:314 Attempting to connect to Elasticsearch version 7.8.1
Which mentions in particular:
could not extract license information from the server response: unknown state, received: 'expired'
- Version: filebeat 7.8.1 (libbeat 7.8.1)
- Operating System: Red Hat Linux
- Steps to Reproduce:
- Setup working filebeat ingestion to elasticsearch
- Expire license
- Watch ingestion stop to work
Hi, we noticed that the license expiration will have an averse effect on filebeat log ingestion.
In our case, our trial license expired, breaking filebeat log ingestion and spiking CPU on our log shipping servers.
Altough the documentation mentions filebeat should continue working on license expiration.
Relevant logs from filebeat:
Which mentions in particular: