Filebeat elasticsearch module sending gc.log even if only server submodule is enabled

[leweafan]

Bug description

Filebeat elasticsearch module sending gc.log even if only server submodule is enabled and gc submodule is disabled.

/etc/filebeat/modules.d/elasticsearch.yml

- module: elasticsearch
  server:
    enabled: true

  gc:
    enabled: false

  audit:
    enabled: true

  slowlog:
    enabled: true

  deprecation:
    enabled: true

gc.log added cause *.log pattern

/usr/share/filebeat/module/elasticsearch/server/manifest.yml

module_version: 1.0

var:
  - name: paths
    default:
      - /var/log/elasticsearch/*.log
      - /var/log/elasticsearch/*_server.json
    os.darwin:
      - /usr/local/var/lib/elasticsearch/*.log
      - /usr/local/var/lib/elasticsearch/*_server.json
    os.windows:
      - c:/ProgramData/Elastic/Elasticsearch/logs/*.log
      - c:/ProgramData/Elastic/Elasticsearch/logs/*_server.json

ingest_pipeline:
  - ingest/pipeline.yml
  - ingest/pipeline-plaintext.yml
  - ingest/pipeline-json.yml
input: config/log.yml

Files like access.log, slowlog.log and deprecation.log excluded but not gc.log

/usr/share/filebeat/module/elasticsearch/server/config/log.yml

type: log
paths:
{{ range $i, $path := .paths }}
 - {{$path}}
{{ end }}
exclude_files: [".gz$","_slowlog.log$","_access.log$","_deprecation.log$"]
multiline:
  pattern: '^(\[[0-9]{4}-[0-9]{2}-[0-9]{2}|{)'
  negate: true
  match: after

processors:
# Locale for time zone is only needed in non-json logs
- add_locale.when.not.regexp.message: "^{"
- add_fields:
    target: ''
    fields:
      ecs.version: 1.9.0

Solution

gc.log should be added to exclude_files:

exclude_files: [".gz$","_slowlog.log$","_access.log$","_deprecation.log$", "gc.log$"]

Version

Filebeat 7.17.1

[leweafan]

Hot fix:

/etc/filebeat/modules.d/elasticsearch.yml

- module: elasticsearch
  # Server log
  server:
    enabled: true

    # Set custom paths for the log files. If left empty,
    # Filebeat will choose the paths depending on your OS.
    #var.paths:
    input:
      exclude_files: ['gc.log$']

[leweafan]

Seems the same issue described a year ago but without solution - #23583

[leweafan]

Also pattern *.log will grab _audit.log which is part of audit module and also should be added to exclude_files like access.log which is part of audit module too.