[BUG] Filebeat memory use issue

[ferullo]

I copied this issue's content from a Discuss post

Minor bug with Filebeat and Endpoint. This is a rare event and only happened to 6 "known" machines out of 100.

Filebeat memory utilization consumed the remaining host memory after a policy change. Steps that created the issue. All settings will be in Fleet under the device policies.

1. Go to policy. Open.
2. Change to settings tab.
3. Uncheck File and Metrics for debug.
4. Save and wait for it to roll out.

The existing Filebeat instance from endpoint did not exit correctly which resulted in the log file backing up in memory waiting to connect to agent to send. Another instance started up with the new settings running concurrently. Force killing the instance of filebeat and the machine returns to normal.

Poking at the dev's for that memory max settings :-). you guys are awesome 7.13.3+ has been very stable so far.

[elasticmachine]

Pinging @elastic/agent (Team:Agent)

[botelastic[bot]]

Hi! We just realized that we haven't looked into this issue in a while. We're sorry!

We're labeling this issue as Stale to make it hit our filters and make sure we get back to it as soon as possible. In the meantime, it'd be extremely helpful if you could take a look at it as well and confirm its relevance. A simple comment with a nice emoji will be enough :+1. Thank you for your contribution!