elastic / elastic/elastic-agent

Filebeat hot-reloads new configuration before restart

Open
#75 0 comments 0 reactions 0 assignees View on GitHub
Team:Elastic-Agent-Control-Plane
Dominant language
Go
Stars
275
Forks
264
Avg merge
1d 20h
Merged PRs (30d)
298

Description

When enabling an integration for a first time, it seems to me that Elastic-Agent passes the configuration to Filebeat, which hot-reloads it before it then restarts the filebeat instance.

This is somewhat confusing for users, because they would usually find a false error message in the agent logs (from Filebeat and not Agent), here is an example:

`{"log.level":"error","@timestamp":"2022-03-07T11:21:03.261Z","log.logger":"input.httpjson-cursor.retryablehttp","log.origin":{"file.name":"go-retryablehttp@v0.6.6/client.go","file.line":553},"message":"request failed","service.name":"filebeat","id":"httpjson-ti_cybersixgill.threat-083b3768-e24f-421d-a1ee-8e57091863fa","input_source":"https://api.cybersixgill.com/taxii/sixgill-taxii/collections/102/objects","input_url":"https://api.cybersixgill.com/taxii/sixgill-taxii/collections/102/objects","error":{"message":"Get \"https://api.cybersixgill.com/taxii/sixgill-taxii/collections/102/objects?added_after=2022-03-07T11%3A21%3A02.982Z&match%5Btype%5D=indicator\": context canceled"},"method":"GET","url":"https://api.cybersixgill.com/taxii/sixgill-taxii/collections/102/objects?added_after=2022-03-07T11%3A21%3A02.982Z&match%5Btype%5D=indicator","ecs.version":"1.6.0"}`

The error `context cancelled` is reported by `httpjson` or any other input with an open socket and a background context.

Would it be possible to make sure Filebeat does not hot-reload before the restart to prevent this?

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.