Problem

Customer reports that there is no data being absorbed by ADI and filebeat throws below error when starting:

CRIT Exiting: Could not start registrar: Error loading state: Error decoding states: EOF

Resolution

Root Cause
The corruption of registry files in .filebeat majorly occurs when there is an ungraceful shutdown of the service. Since version 5.0 filebeat does some checks of the registry file if it is in valid state and with 5.1 additional checks were introduced. The problem before was, that the above issues were not even detected. Now if there is an invalid registry file, filebeat will not start and will produce error. You can find more information on this issue on the below link: https://github.com/elastic/beats/issues/3537

Solution
a. Filebeat service is already stopped.
b. Navigate to [API_GTW]/tools/[Filebeat]/ and remove the .filebeat file.
c. Now start the filebeat service and verify in filebeat.log that service is running successfully.

Mitigation Steps
Avoid any ungraceful shutdown of filebeat. It is also recommended to register filebeat as a service rather than simply running the script with nohup command.