Error creating runner in Kubernetes autodiscover

Elastic Stack Beats
1

Hi there,
I am trying to gather logs from kubernetes, using filebeat and forwarding to Elasticsearch.

I have configured autoconfigure and added -d autodiscover to the arguments to activate more autodiscover logging.

My logs are full of errors similar to this:
2019-05-29T09:36:30.078Z ERROR [autodiscover] cfgfile/list.go:96 Error creating runner from config: Can only start an input when all related states are finished: {Id:31721366-2113 Finished:false Fileinfo:0xc001d43790 Source:/var/lib/docker/containers/5257ad3fe2ba19eb8274db4b6cde68d37284a09dcc398ea3f45602f106b4ce23/5257ad3fe2ba19eb8274db4b6cde68d37284a09dcc398ea3f45602f106b4ce23-json.log Offset:0 Timestamp:2019-05-29 09:35:02.421006566 +0000 UTC m=+94.338924682 TTL:-1ns Type:docker Meta:map[] FileStateOS:31721366-2113}

I am running filebeat 7.1.1 and the following config:

filebeat:
   config:
     modules:
   path: ${path.config}/modules.d/*.yml
   reload.enabled: false
filebeat.autodiscover:
  providers:
    - type: kubernetes
      hints.enabled: true
      include_annotations:
        - co.elastic.logs/disable
        - 'co.elastic.logs/processors.decode_json_fields.fields'
        - 'co.elastic.logs/processors.decode_json_fields.target'
        - 'co.elastic.logs/processors.decode_json_fields.process_array'
        - 'json_logs'
      exclude_labels:
      in_cluster: true
      processors:
        - drop_event:
            when:
              equals:
                kubernetes.container.name: "filebeat"
      appenders:
        - type: config
          config:
            fields:
              sage_note: "I am here 20"
output.elasticsearch:
  hosts: ['log-elasticsearch-client:9200']
output.file:
  enabled: false
http.enabled: true
http.port: 5066

I am trying to understand how the logs are consumed, and what causes the error.

I have looked at the following issue, but it is not solved:

Two topics here have different errors:

Any help appreciated.

mfg lutz

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.