I am using FileBeat to transfer my kubernetes nginx-ingress controller logs to ElasticSearch. I deploy a pod with a filebeat container in it. I configure the filebeat "path.data" to a fileshare on Azure, to prevent that when a pod crashes, the filebeat container in the new pod will resend all previous logs again to ElasticSearch. So in order to prevent duplicate data i keep the filebeat state on a fileshare.
On an empty fileshare, the first pod creates all files in the data dir an does not complain. When i delete te pod and a new instance is automatically restarted, the filebeat in it is not able to start and complains with the message below:
2021-03-24T16:03:25.308Z ERROR instance/beat.go:971 Exiting: failed to open store 'filebeat': failed to update meta file permissions: chmod /usr/share/filebeat/data/registry/filebeat/meta.json: operation not permitted
Exiting: failed to open store 'filebeat': failed to update meta file permissions: chmod /usr/share/filebeat/data/registry/filebeat/meta.json: operation not permitted
Is there a solution to this problem or another way to achieve a new filebeat container does not send the same access logs again?