filebeat dynamically linked

[cleesmith]

When I download Filebeat 1.1.0 LINUX 64-BIT and do file filebeat:

ELF 64-bit LSB  executable, x86-64, version 1 (SYSV), dynamically linked (uses shared libs), not stripped

What are the shared libs it's depending on?
Is it possible to be statically linked?

[ruflin]

This is related to elastic/beats-packer#23

[andrewkroh]

@cleesmith, use the command line tool ldd to list the dependencies.

Yes, it possible. If you build it yourself it will be statically linked. See CONTRIBUTING for how to build.

[cleesmith]

Thanks all. I was able to compile locally and it is static.
I was only doing this to compare filebeat circa Nov 2015 to filebeat as of now.
Someone using unifiedbeat complained about high cpu/thread usage even when it is just idle, so
I would like to update unifiedbeat with the latest filebeat changes ... I think filebeat has improved since then.

[ruflin]

@cleesmith There were quite a few improvements on filebeat and libbeat side since then. Let us know if you get stuck updating and need some help. I'm now also watching your repo and this issue here: cleesmith/unifiedbeat#3

[cleesmith]

@ruflin thank you. I really need to re-think how to best reuse filebeat. Both unifiedbeat and filebeat do almost the same thing but with different files/data. It would also be nice to have a way to only "tail" and read from the most recent file ... and not to continue watching/harvesting from files that will never have any new data added to them ... I think that is where the excessive cpu usage comes from, I think.

[ruflin]

Have a look here at the close_older option which was introduced: #718