What Filebeat “no non-zero metrics in the last 30s” means

This is an informational monitoring message, not an error by itself. In releases that emit this wording, Filebeat has no non-zero metric changes to report for that interval. It is often seen when the collector is idle, but the message alone does not prove that every stage of the ingestion path is healthy.

Check whether new events are expected

If the application has written no new logs, an idle report can be normal. If the application is actively writing while expected documents remain absent, investigate the input and output separately. Current Filebeat releases log snapshots of internal metrics, including counter changes and current gauge values; wording and field names vary by version.

Verify the input path and state

A current filestream configuration needs a stable, unique input ID:

filebeat.inputs:
  - type: filestream
    id: myapp-logs
    paths:
      - /var/log/myapp/*.log

Check that the pattern matches real files in Filebeat's filesystem namespace. A path visible on the host may not be mounted inside its container. Confirm that the effective process user can read the files and traverse their parent directories.

Existing content is not necessarily new content: the registry may already record the file as read. Also inspect ignore_older if it is configured; age-based exclusion is not enabled by default. With fingerprint-based filestream identity, a small file may wait until it reaches the configured fingerprint length before ingestion. Check that setting for your version instead of assuming a short test line will appear immediately.

Inspect readers and downstream delivery

Look for file-open and harvester activity, input exclusions, parse errors, and output errors. Rotation behavior depends on file identity, matching paths, and the rotation method. Neither a current nor a legacy input guarantees correct collection under every rotation scheme.

If output is blocked, queues can fill and apply backpressure. Compare added, published, acknowledged, and failed event counters where available. A collector can have opened the correct file yet still fail to deliver its events.

Reduce noise without hiding the problem

The message is informational. Raising the threshold to logging.level: warning suppresses informational logs, but also removes useful diagnostics. Where supported, logging.metrics.enabled: false disables periodic metrics logging more specifically; keep another way to observe collector health before changing it.

See Elastic's metrics log guide and filestream reference.