elastic / elastic/elastic-agent
Filebeat hot-reloads new configuration before restart
- Dominant language
- Go
- Stars
- 275
- Forks
- 264
- Avg merge
- 1d 20h
- Merged PRs (30d)
- 298
Description
When enabling an integration for a first time, it seems to me that Elastic-Agent passes the configuration to Filebeat, which hot-reloads it before it then restarts the filebeat instance.
This is somewhat confusing for users, because they would usually find a false error message in the agent logs (from Filebeat and not Agent), here is an example:
`{"log.level":"error","@timestamp":"2022-03-07T11:21:03.261Z","log.logger":"input.httpjson-cursor.retryablehttp","log.origin":{"file.name":"go-retryablehttp@v0.6.6/client.go","file.line":553},"message":"request failed","service.name":"filebeat","id":"httpjson-ti_cybersixgill.threat-083b3768-e24f-421d-a1ee-8e57091863fa","input_source":"https://api.cybersixgill.com/taxii/sixgill-taxii/collections/102/objects","input_url":"https://api.cybersixgill.com/taxii/sixgill-taxii/collections/102/objects","error":{"message":"Get \"https://api.cybersixgill.com/taxii/sixgill-taxii/collections/102/objects?added_after=2022-03-07T11%3A21%3A02.982Z&match%5Btype%5D=indicator\": context canceled"},"method":"GET","url":"https://api.cybersixgill.com/taxii/sixgill-taxii/collections/102/objects?added_after=2022-03-07T11%3A21%3A02.982Z&match%5Btype%5D=indicator","ecs.version":"1.6.0"}`
The error `context cancelled` is reported by `httpjson` or any other input with an open socket and a background context.
Would it be possible to make sure Filebeat does not hot-reload before the restart to prevent this?
Contributor guide
Assessment
This issue has not been assessed yet.