Info No Non-zero Metrics in the Last 30s Message in Filebeat

The "Info No Non-zero Metrics in the Last 30s" message in Filebeat indicates that Filebeat hasn't collected or processed any log data within the last 30 seconds. This message is usually part of the internal metrics reporting and isn't necessarily an error but rather an informational log indicating that no log entries were processed or that Filebeat wasn't able to read any data.

Here are some common reasons for this message and steps to troubleshoot:

1. Verify Log Files and Paths

Ensure that Filebeat is correctly configured to read from the specified log file paths.

• Check Filebeat Configuration:

  • Open your Filebeat configuration file (filebeat.yml) and verify that the paths defined under filebeat.inputs are correct.

  • For example:

     

    Copied!

    filebeat.inputs:
      - type: log
        paths:
          - /path/to/your/logfile.log
    

• Verify File Access:

  • Ensure that Filebeat has the necessary permissions to read the log files.

2. Check File Permissions

Verify that the file permissions are set correctly, and Filebeat can access the log files.

• On Linux:

   

  Copied!

  ls -l /path/to/your/logfile.log
  

• On Windows: Check the file properties and permissions.

3. Ensure Logs Are Being Written

Ensure that the log files are being written to and are not empty.

• Check Log File Size:
  • Verify that the log file is not empty and is being updated.

4. Check Filebeat Service Status

Ensure that the Filebeat service is running correctly.

• On Linux:

   

  Copied!

  sudo systemctl status filebeat
  

• On Windows: Check the service status in the Services app or use PowerShell:

   

  Copied!

  Get-Service filebeat
  

5. Review Filebeat Logs

Check Filebeat's own logs for any additional errors or warnings that might indicate a problem.

• On Linux:

   

  Copied!

  sudo tail -f /var/log/filebeat/filebeat.log
  

• On Windows: Review the logs in the location specified by the logging configuration in filebeat.yml, or use the Event Viewer.

6. Filebeat Configuration Example

Ensure your configuration is correctly set to capture the logs you intend to monitor. A basic example configuration might look like this:

filebeat.inputs:
  - type: log
    enabled: true
    paths:
      - /path/to/your/logfile.log
    exclude_files: ['.gz$']

output.elasticsearch:
  hosts: ["localhost:9200"]

7. Restart Filebeat

After making any changes to the configuration or verifying permissions, restart Filebeat to apply the changes.

• On Linux:

   

  Copied!

  sudo systemctl restart filebeat
  

• On Windows:

   

  Copied!

  Restart-Service filebeat
  

8. Ensure Proper Filebeat Version

Ensure you are using a version of Filebeat that is compatible with your Elasticsearch and Logstash versions.

Summary

• Verify the log file paths and ensure they are correct and accessible.
• Check that Filebeat has the necessary permissions to read the log files.
• Ensure that logs are being written to the files.
• Review Filebeat logs for any errors or warnings.
• Restart Filebeat after making any configuration changes.

If you follow these steps and the issue persists, you might want to further investigate the specific context of the logs or consider reaching out to the Elastic community for more targeted help.

Got an article suggestion? Let us know

Explore more

Filebeat

This work is licensed under a Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International License.