# Filebeat harvester unable to open file and unable to send logs to logstash

**URL:** <https://discuss.elastic.co/t/filebeat-harvester-unable-to-open-file-and-unable-to-send-logs-to-logstash/313675>\
**Category:** Beats\
**Tags:** docker, filebeat\
**Created:** [September 5, 2022, 11:02am UTC](https://discuss.elastic.co/t/filebeat-harvester-unable-to-open-file-and-unable-to-send-logs-to-logstash/313675 "2022-09-05T11:02:10Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![SumitSingh](https://avatars.discourse-cdn.com/v4/letter/s/7feea3/32.png) [@SumitSingh](https://discuss.elastic.co/u/SumitSingh)\
**Post date:** [September 5, 2022, 11:02am UTC](https://discuss.elastic.co/t/filebeat-harvester-unable-to-open-file-and-unable-to-send-logs-to-logstash/313675/1 "2022-09-05T11:02:10Z")

</div>

Hello Folks,  
I have installed Elastic filebeat as a sidecar container in kubernetes cluster with main application "Sonarqube". I want to ships the sonarqube logs to logstash. Filebeat container is running and reading some metrics but not sending logs.

Your support really help me get through to this.

_// values.yaml_

```auto
  edition: enterprise

  postgresql:
    enabled: false

  jdbcOverwrite:
    enable: true
    jdbcUsername: "username"
    jdbcSecretName: "secretname"
    jdbcSecretPasswordKey: "password"
    jdbcUrl: "jdbc:postgresql://servername:5432"

  ingress:
    enabled: true
    ingressClassName: nginx
    tls:
    - secretName: soanrqube-certificate
      hosts:
      - sonarqube-dev.xyz.com
    hosts:
    - name: sonarqube-dev.xyz.com
  extraContainers:
    - name: filebeat-sonar
      image: docker.elastic.co/beats/filebeat:8.3.3
      imagePullPolicy: Always
      volumeMounts:
        - name: sonarqube
          mountPath: /opt/sonarqube/logs
          subPath: logs
        - name: filebeat-config
          mountPath: /etc/filebeat.yml
          subPath: filebeat.yml
          readOnly: true
  persistence:
    volumes:
      - name: sonarqube
        emptyDir: {}
      - name: filebeat-config
        configMap:
          name: filebeat-configmap
          defaultMode: 0600

```

_// filebeat-configmap.yaml_

```auto
apiVersion: v1
kind: ConfigMap
metadata:
  name: filebeat-configmap
data:
    filebeat.yml: |-
      filebeat.inputs:
      - type: container
        enabled: true
        paths:
          - /opt/sonarqube/logs/*
      output.logstash:
        hosts: ["logstashhost:5044"]

```

_// filebeat pod's logs_

```auto
{"log.level":"info","@timestamp":"2022-09-05T08:21:54.173Z","log.logger":"monitoring","log.origin":{"file.name":"log/log.go","file.line":185},"message":"Non-zero metrics in the last 30s","service.name":"filebeat","monitoring":{"metrics":{"beat":{"cgroup":{"cpuacct":{"total":{"ns":10679378}},"memory":{"mem":{"usage":{"bytes":-118784}}}},"cpu":{"system":{"ticks":30},"total":{"ticks":150,"time":{"ms":10},"value":0},"user":{"ticks":120,"time":{"ms":10}}},"handles":{"limit":{"hard":1048576,"soft":1048576},"open":9},"info":{"ephemeral_id":"57e6a626-6bc3-4086-ad29-3fba60617892","uptime":{"ms":270068},"version":"8.3.3"},"memstats":{"gc_next":18201160,"memory_alloc":8909856,"memory_total":53916472,"rss":103178240},"runtime":{"goroutines":27}},"filebeat":{"harvester":{"open_files":0,"running":0}},"libbeat":{"config":{"module":{"running":0}},"output":{"events":{"active":0}},"pipeline":{"clients":0,"events":{"active":0}}},"registrar":{"states":{"current":0}},"system":{"load":{"1":0.42,"15":0.15,"5":0.24,"norm":{"1":0.0525,"15":0.0188,"5":0.03}}}},"ecs.version":"1.6.0"}}

```

---

<div class="post-metadata">

**Author:** ![mtojek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mtojek/32/63863_2.png) [@mtojek](https://discuss.elastic.co/u/mtojek)\
**Post date:** [September 5, 2022, 2:45pm UTC](https://discuss.elastic.co/t/filebeat-harvester-unable-to-open-file-and-unable-to-send-logs-to-logstash/313675/2 "2022-09-05T14:45:49Z")

</div>

You may want to enable debug logs to see more details about what's under the hood.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 3, 2022, 4:46pm UTC](https://discuss.elastic.co/t/filebeat-harvester-unable-to-open-file-and-unable-to-send-logs-to-logstash/313675/3 "2022-10-03T16:46:19Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.