Error : invalid memory address or nil pointer dereference

Elastic Stack Beats
1

Hello,
when do I start the client filebeat in my container I have the following error message in my script
the command to boot the client is as followsthe command to boot the client is as follows

exec /usr/bin/filebeat -c /opt/filebeat/filebeat.yml -e -v

Initializing Filebeat...
Start Filebeat ...
Error opening syslog: Unix syslog delivery error
panic: runtime error: invalid memory address or nil pointer dereference

[signal 0xb code=0x1 addr=0x10 pc=0x54edc4]

goroutine 25 [running]:
github.com/elastic/beats/filebeat/harvester.(*Harvester).Harvest.func1(0xc8202c4600)
/go/src/github.com/elastic/beats/filebeat/harvester/log.go:91 +0x54
github.com/elastic/beats/filebeat/harvester.(*Harvester).Harvest(0xc8202c4600)
/go/src/github.com/elastic/beats/filebeat/harvester/log.go:158 +0xa84
created by github.com/elastic/beats/filebeat/harvester.(*Harvester).Start
/go/src/github.com/elastic/beats/filebeat/harvester/harvester.go:82 +0x35

goroutine 1 [runnable]:
github.com/elastic/beats/filebeat/crawler.(*Crawler).Start(0xc8200a7cc0, 0xc82029c300, 0x1, 0x1, 0xc8202a5440)
/go/src/github.com/elastic/beats/filebeat/crawler/crawler.go:60 +0x5eb
github.com/elastic/beats/filebeat/beat.(*Filebeat).Run(0xc82000f320, 0xc8200130e0, 0x0, 0x0)
/go/src/github.com/elastic/beats/filebeat/beat/filebeat.go:92 +0x462
github.com/elastic/beats/libbeat/beat.(*Beat).Run(0xc8200130e0)
/go/src/github.com/elastic/beats/libbeat/beat/beat.go:176 +0x31c
github.com/elastic/beats/libbeat/beat.Run(0x94be90, 0x8, 0x936eb8, 0x5, 0x7fcc54763ef8, 0xc82000f320, 0xc8200fe1e0)
/go/src/github.com/elastic/beats/libbeat/beat/beat.go:86 +0x25b
main.main()
/go/src/github.com/elastic/beats/filebeat/main.go:21 +0x9d

goroutine 17 [syscall, locked to thread]:
runtime.goexit()
/usr/local/go/src/runtime/asm_amd64.s:1696 +0x1

goroutine 5 [syscall]:
os/signal.loop()
/usr/local/go/src/os/signal/signal_unix.go:22 +0x18
created by os/signal.init.1
/usr/local/go/src/os/signal/signal_unix.go:28 +0x37

goroutine 18 [select]:
github.com/elastic/beats/libbeat/publisher.(*messageWorker).run(0xc8202a2000)
/go/src/github.com/elastic/beats/libbeat/publisher/worker.go:61 +0x449
created by github.com/elastic/beats/libbeat/publisher.(*messageWorker).init
/go/src/github.com/elastic/beats/libbeat/publisher/worker.go:55 +0x11e

goroutine 19 [select]:
github.com/elastic/beats/libbeat/publisher.(*bulkWorker).run(0xc8202da000)
/go/src/github.com/elastic/beats/libbeat/publisher/bulk.go:58 +0x371
created by github.com/elastic/beats/libbeat/publisher.newBulkWorker
/go/src/github.com/elastic/beats/libbeat/publisher/bulk.go:42 +0x222

goroutine 20 [runnable, locked to thread]:
runtime.gopark(0xa19aa8, 0xc8202a51f8, 0x94a300, 0x9, 0x16, 0x3)
/usr/local/go/src/runtime/proc.go:185 +0x163
runtime.goparkunlock(0xc8202a51f8, 0x94a300, 0x9, 0x16, 0x3)
/usr/local/go/src/runtime/proc.go:191 +0x54
runtime.chansend(0x7cbe00, 0xc8202a51a0, 0xc82001cf0c, 0xc82001ce01, 0x452709, 0x2)
/usr/local/go/src/runtime/chan.go:197 +0x499
runtime.chansend1(0x7cbe00, 0xc8202a51a0, 0xc82001cf0c)
/usr/local/go/src/runtime/chan.go:92 +0x43
runtime.ensureSigM.func1()
/usr/local/go/src/runtime/signal1_unix.go:238 +0x2a9
runtime.goexit()
/usr/local/go/src/runtime/asm_amd64.s:1696 +0x1

goroutine 21 [runnable]:
github.com/elastic/beats/libbeat/service.HandleSignals.func1(0xc8202a5140, 0xc82029ec40, 0xc820294ae0)
/go/src/github.com/elastic/beats/libbeat/service/service.go:28
created by github.com/elastic/beats/libbeat/service.HandleSignals
/go/src/github.com/elastic/beats/libbeat/service/service.go:32 +0x1f8

goroutine 23 [runnable]:
github.com/elastic/beats/filebeat/beat.(*Spooler).Run(0xc8202b43c0)
/go/src/github.com/elastic/beats/filebeat/beat/spooler.go:65
created by github.com/elastic/beats/filebeat/beat.(*Filebeat).Run
/go/src/github.com/elastic/beats/filebeat/beat/filebeat.go:90 +0x421

goroutine 24 [sleep]:
time.Sleep(0x3b9aca00)
/usr/local/go/src/runtime/time.go:59 +0xf9
github.com/elastic/beats/filebeat/crawler.(*Prospector).stdinRun(0xc820318000, 0xc8202a5440)
/go/src/github.com/elastic/beats/filebeat/crawler/prospector.go:230 +0x27c
github.com/elastic/beats/filebeat/crawler.(*Prospector).Run(0xc820318000, 0xc8202a5440)
/go/src/github.com/elastic/beats/filebeat/crawler/prospector.go:146 +0x1c1
created by github.com/elastic/beats/filebeat/crawler.(*Crawler).Start
/go/src/github.com/elastic/beats/filebeat/crawler/crawler.go:52 +0x47c

What is the problem ?
thanks

2

Which filebeat version are you using? Can you share your config file?

3

Version: 1.2.3

> ################### Filebeat Configuration Example #########################

> ############################# Filebeat ######################################
> filebeat:
>   # List of prospectors to fetch data.
>   prospectors:
>     # Each - is a prospector. Below are the prospector specific configurations
>     -
>       # Possible options are:
>       # * log: Reads every line of the log file (default)
>       # * stdin: Reads the standard in
>       input_type: stdin

>       # Type to be published in the 'type' field. For Elasticsearch output,
>       # the type defines the document type these entries should be stored
>       # in. Default: log
>       document_type: filebeat-docker-logs

>       

> ###############################################################################
> ############################# Libbeat Config ##################################
> # Base config file used by all other beats for using libbeat features

> ############################# Output ##########################################

> # Configure what outputs to use when sending the data collected by the beat.
> # Multiple outputs may be used.
> output:

>     ### Logstash as output
>   logstash:
>     # The Logstash hosts
>     hosts: ["{{LOGSTASH_HOST}}:{{LOGSTASH_PORT}}"]

>     # Optional TLS. By default is off.
>     #tls:
>       # List of root certificates for HTTPS server verifications
>       #certificate_authorities: ["/etc/pki/root/ca.pem"]

>       # Certificate for TLS client authentication
>       #certificate: "/etc/pki/client/cert.pem"

>       # Client Certificate Key
>       #certificate_key: "/etc/pki/client/cert.key"

>       # Controls whether the client verifies server certificates and host name.
>       # If insecure is set to true, all server host names and certificates will be
>       # accepted. In this mode TLS based connections are susceptible to
>       # man-in-the-middle attacks. Use only for testing.
>       #insecure: true

>       # Configure cipher suites to be used for TLS connections
>       #cipher_suites: []

>       # Configure curve types for ECDHE based cipher suites
>       #curve_types: []


>   ### File as output
>   #file:
>     # Path to the directory where to save the generated files. The option is mandatory.
>     #path: "/tmp/filebeat"

>     # Name of the generated files. The default is `filebeat` and it generates files: `filebeat`, `filebeat.1`, `filebeat.2`, etc.
>     #filename: filebeat

>     # Maximum size in kilobytes of each file. When this size is reached, the files are
>     # rotated. The default value is 10 MB.
>     #rotate_every_kb: 10000

>     # Maximum number of files under path. When this number of files is reached, the
>     # oldest file is deleted and the rest are shifted from last to first. The default
>     # is 7 files.
>     #number_of_files: 7

> ############################# Shipper #########################################

> shipper:
>   # The name of the shipper that publishes the network data. It can be used to group
>   # all the transactions sent by a single shipper in the web interface.
>   # If this options is not defined, the hostname is used.
>   name: {{SHIPPER_NAME}}

> ############################# Logging #########################################

> # There are three options for the log ouput: syslog, file, stderr.
> # Under Windos systems, the log files are per default sent to the file output,
> # under all other system per default to syslog.
> logging:

>   # Send all logging output to syslog. On Windows default is false, otherwise
>   # default is true.
>   #to_syslog: true

>   # Write all logging output to files. Beats automatically rotate files if rotateeverybytes
>   # limit is reached.
>   #to_files: false

>   # To enable logging to files, to_files option has to be set to true
>   files:
>     # The directory where the log files will written to.
>     path: /opt/filebeat

>     # The name of the files where the logs are written to.
>     name: filebeat.log
>     rotateeverybytes: 10485760 # = 10MB

>     # Number of rotated log files to keep. Oldest files will be deleted first.
>     keepfiles: 7

>   # Sets log level. The default log level is error.
>   # Available log levels are: critical, error, warning, info, debug
>   level: {{LOG_LEVEL}}

variables under {} are changed with the command sed in my script

4

can you help me ?

5

What is your operating system of the container? I see that you use stdin as input type. What kind of input do you plan to read?

6

it's red-hat OS , i use command kubernetes to recover the logs container

/usr/bin/kubectl logs ${CONTAINER} --namespace ${CONTAINER_NAMESPACE} --since=${LOGTIME}s

and send the result to logstash

7

This topic was automatically closed after 21 days. New replies are no longer allowed.