Failed to update meta file permissions: chmod /usr/share/filebeat/data/registry/filebeat/meta.json: operation not permitted

Elastic Stack Beats
1

I am using FileBeat to transfer my kubernetes nginx-ingress controller logs to ElasticSearch. I deploy a pod with a filebeat container in it. I configure the filebeat "path.data" to a fileshare on Azure, to prevent that when a pod crashes, the filebeat container in the new pod will resend all previous logs again to ElasticSearch. So in order to prevent duplicate data i keep the filebeat state on a fileshare.
On an empty fileshare, the first pod creates all files in the data dir an does not complain. When i delete te pod and a new instance is automatically restarted, the filebeat in it is not able to start and complains with the message below:

2021-03-24T16:03:25.308Z ERROR instance/beat.go:971 Exiting: failed to open store 'filebeat': failed to update meta file permissions: chmod /usr/share/filebeat/data/registry/filebeat/meta.json: operation not permitted
Exiting: failed to open store 'filebeat': failed to update meta file permissions: chmod /usr/share/filebeat/data/registry/filebeat/meta.json: operation not permitted

Is there a solution to this problem or another way to achieve a new filebeat container does not send the same access logs again?

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.