Filebeat -> Exiting: failed reading meta file: unexpected end of JSON input

Elastic Stack Beats
1

Good afternoon,

OS: Ubuntu 22.04

I tried Filebeat (version 8.5 and 7.17.1). Both versions cannot be started with the error:

{"log.level":"error","@timestamp":"2022-11-09T11:28:21.598Z","log.origin":{"file.name":"instance/beat.go","file.line":1056},"message":"Exiting: failed reading meta file: unexpected end of JSON input","service.name":"filebeat","ecs.version":"1.6.0"}
Exiting: failed reading meta file: unexpected end of JSON input

Cannot find any solution on the Internet.

2

Hi Dissonance,

Welcome! End of file errors such as that are normally an issue with your configuration such as a missing close quote or bracket. Can you check and share your configuration please?

3

Yes, here is my config.

Seccomp section is used because of glibc issue (Detailed: https://kifarunix.com/how-to-fix-filebeat-glibc-related-errors/#allow-filebeat-rseq-syscall)

---
filebeat.inputs:
  - type: filestream
    id: my-filestream-id
    enabled: false
    paths:
      - /var/log/*.log
filebeat.config.modules:
  path: ${path.config}/modules.d/*.yml
  reload.enabled: false
setup.template.settings:
  index.number_of_shards: 1
output.logstash:
  hosts: ["localhost:5044"]
processors:
  - add_host_metadata:
      when.not.contains.tags: forwarded
  - add_cloud_metadata: ~
  - add_docker_metadata: ~
  - add_kubernetes_metadata: ~

seccomp:
  default_action: allow
  syscalls:
    - action: allow
      names:
        - rseq

1
11407×573 213 KB

2
21638×195 148 KB

4

The problem has been sorted out.
Wrong Ubuntu distributive. Thank you.