Filebeat crashed when processing messages from sqs queue

I was able to fix the issue myself. The documentation of elastic on k8s is wrong.
The service account for fleet 7.15.0 must allow resource list permission of nodes and pods.
This service account permission is different from fleet 7.14.1

rules:

  • apiGroups: [""] # "" indicates the core API group
    resources:
    • pods
    • nodes