beats icon indicating copy to clipboard operation
beats copied to clipboard

Add Filebeat registry to the diagnostics bundle for the control V2 protocol

Open rdner opened this issue 3 years ago • 1 comments

Describe the enhancement:

It's possible to register a hook in the control protocol V2 so when the agent requests diagnostics from Filebeat it could send some data useful for debugging back to the agent. This should include the Filebeat registry as well.

Describe a specific use case for the enhancement or feature:

We had a few SDHs that were related to the changed inode value of the input file with the same filename. Filebeat gets confused and can ingest lines multiple times. This might happen due to a log rotation strategy or using a network share as a source filesystem. To diagnose this, we need to scan through the registry log file log.json. It can be done, for example, with this tool.

rdner avatar Sep 30 '22 12:09 rdner

Pinging @elastic/elastic-agent-data-plane (Team:Elastic-Agent-Data-Plane)

elasticmachine avatar Sep 30 '22 12:09 elasticmachine