# Failed to update meta file permissions: chmod /usr/share/filebeat/data/registry/filebeat/meta.json: operation not permitted

**URL:** <https://discuss.elastic.co/t/failed-to-update-meta-file-permissions-chmod-usr-share-filebeat-data-registry-filebeat-meta-json-operation-not-permitted/268244>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [March 24, 2021, 4:41pm UTC](https://discuss.elastic.co/t/failed-to-update-meta-file-permissions-chmod-usr-share-filebeat-data-registry-filebeat-meta-json-operation-not-permitted/268244 "2021-03-24T16:41:31Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![mdeheegher](https://avatars.discourse-cdn.com/v4/letter/m/9e8a1a/32.png) [@mdeheegher](https://discuss.elastic.co/u/mdeheegher)\
**Post date:** [March 24, 2021, 4:41pm UTC](https://discuss.elastic.co/t/failed-to-update-meta-file-permissions-chmod-usr-share-filebeat-data-registry-filebeat-meta-json-operation-not-permitted/268244/1 "2021-03-24T16:41:31Z")

</div>

I am using FileBeat to transfer my kubernetes nginx-ingress controller logs to ElasticSearch. I deploy a pod with a filebeat container in it. I configure the filebeat "path.data" to a fileshare on Azure, to prevent that when a pod crashes, the filebeat container in the new pod will resend all previous logs again to ElasticSearch. So in order to prevent duplicate data i keep the filebeat state on a fileshare.  
On an empty fileshare, the first pod creates all files in the data dir an does not complain. When i delete te pod and a new instance is automatically restarted, the filebeat in it is not able to start and complains with the message below:

**2021-03-24T16:03:25.308Z ERROR instance/beat.go:971 Exiting: failed to open store 'filebeat': failed to update meta file permissions: chmod /usr/share/filebeat/data/registry/filebeat/meta.json: operation not permitted**  
**Exiting: failed to open store 'filebeat': failed to update meta file permissions: chmod /usr/share/filebeat/data/registry/filebeat/meta.json: operation not permitted**

Is there a solution to this problem or another way to achieve a new filebeat container does not send the same access logs again?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 21, 2021, 6:41pm UTC](https://discuss.elastic.co/t/failed-to-update-meta-file-permissions-chmod-usr-share-filebeat-data-registry-filebeat-meta-json-operation-not-permitted/268244/2 "2021-04-21T18:41:48Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.