{"action":"created","issue":{"url":"https://api.github.com/repos/elastic/beats/issues/2044","repository_url":"https://api.github.com/repos/elastic/beats","labels_url":"https://api.github.com/repos/elastic/beats/issues/2044/labels{/name}","comments_url":"https://api.github.com/repos/elastic/beats/issues/2044/comments","events_url":"https://api.github.com/repos/elastic/beats/issues/2044/events","html_url":"https://github.com/elastic/beats/issues/2044","id":165779230,"number":2044,"title":"Duplicate events when filebeat is killed with SIGHUP/SIGINT","user":{"login":"robin13","id":174291,"avatar_url":"https://avatars.githubusercontent.com/u/174291?v=3","gravatar_id":"","url":"https://api.github.com/users/robin13","html_url":"https://github.com/robin13","followers_url":"https://api.github.com/users/robin13/followers","following_url":"https://api.github.com/users/robin13/following{/other_user}","gists_url":"https://api.github.com/users/robin13/gists{/gist_id}","starred_url":"https://api.github.com/users/robin13/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/robin13/subscriptions","organizations_url":"https://api.github.com/users/robin13/orgs","repos_url":"https://api.github.com/users/robin13/repos","events_url":"https://api.github.com/users/robin13/events{/privacy}","received_events_url":"https://api.github.com/users/robin13/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/elastic/beats/labels/Filebeat","name":"Filebeat","color":"008000"}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":2,"created_at":"2016-07-15T12:46:15Z","updated_at":"2016-07-18T10:39:10Z","closed_at":null,"body":"Please post all questions and issues on https://discuss.elastic.co/c/beats\r\nbefore opening a Github Issue. Your questions will reach a wider audience there,\r\nand if we confirm that there is a bug, then you can open a new issue.\r\n\r\nFor confirmed bugs, please report:\r\n- Version: filebeat 1.2.3 and 5.0.0 alpha4 with logstash 5.0.0 alpha4\r\n- Operating System: Ubuntu 14.0.4\r\n- Steps to Reproduce: \r\n\r\nKill filebeat with SIGHUP (as is done when using the standard service restart: `service filebeat restart`) and then restart will result in duplicate events.  A SIGHUP should be considered a normal restart, and filebeat should wait for ACK from logstash before exiting.\r\n\r\nAttached are sample configurations for logstash and filebeat and a test script to run the test multiple times in sequence to reproduce.\r\n\r\n[test.tar.gz](https://github.com/elastic/beats/files/365955/test.tar.gz)\r\n\r\nRelated: https://github.com/elastic/beats/issues/2041\r\n\r\nNote - for the script to work you must start logstash with the `-r` restart option.  The line in the script which adds a comment to the logstash configuration causes logstash to reload the configuration and flush the lines.  Logshash file output _should_ flush everything to file after 5 seconds, but does not seem to be honouring this now...\r\n"},"comment":{"url":"https://api.github.com/repos/elastic/beats/issues/comments/233296423","html_url":"https://github.com/elastic/beats/issues/2044#issuecomment-233296423","issue_url":"https://api.github.com/repos/elastic/beats/issues/2044","id":233296423,"user":{"login":"ruflin","id":244900,"avatar_url":"https://avatars.githubusercontent.com/u/244900?v=3","gravatar_id":"","url":"https://api.github.com/users/ruflin","html_url":"https://github.com/ruflin","followers_url":"https://api.github.com/users/ruflin/followers","following_url":"https://api.github.com/users/ruflin/following{/other_user}","gists_url":"https://api.github.com/users/ruflin/gists{/gist_id}","starred_url":"https://api.github.com/users/ruflin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ruflin/subscriptions","organizations_url":"https://api.github.com/users/ruflin/orgs","repos_url":"https://api.github.com/users/ruflin/repos","events_url":"https://api.github.com/users/ruflin/events{/privacy}","received_events_url":"https://api.github.com/users/ruflin/received_events","type":"User","site_admin":false},"created_at":"2016-07-18T10:39:10Z","updated_at":"2016-07-18T10:39:10Z","body":"The current behaviour is somehow expected, as the connection is \"just\" closed. I think the best option would be to introduce a config option like `shutdown_timeout` or something similar where a  timeout can be configured. I would keep it set to 0 by default as the \"sane\" amount can be very different depending on how many messages are sent and if servers are reachable. So it is up to the user to find the right value in his case."}}
{"actor":{"display_login":"ruflin"}}