# Filebeat K8s deployment - Duplicated Filestream ID

**URL:** <https://discuss.elastic.co/t/filebeat-k8s-deployment-duplicated-filestream-id/338008>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [July 10, 2023, 9:40am UTC](https://discuss.elastic.co/t/filebeat-k8s-deployment-duplicated-filestream-id/338008 "2023-07-10T09:40:27Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![msanft](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/msanft/32/123250_2.png) [@msanft](https://discuss.elastic.co/u/msanft)\
**Post date:** [July 10, 2023, 9:40am UTC](https://discuss.elastic.co/t/filebeat-k8s-deployment-duplicated-filestream-id/338008/1 "2023-07-10T09:40:27Z")

</div>

Hey all,

I'm deploying Filebeat in a Kubernetes cluster as a daemonset. I see the following error message in the Filebeat Pod logs:

```auto
{
   "log.level":"error",
   "@timestamp":"2023-07-10T09:18:38.720Z",
   "log.logger":"input",
   "log.origin":{
      "file.name":"input-logfile/manager.go",
      "file.line":182
   },
   "message":"filestream input with ID 'container-abc' already exists, this will lead to data duplication, please use a different ID",
   "service.name":"filebeat",
   "ecs.version":"1.6.0"
}

```

In my understanding, the filestream IDs should be scoped to the current node, not to the whole cluster, right? Therefore, the individual pods in the daemonset (which obviously all have the same filestream ID, `container-abc`) should not interfere with each other, right?

What else could be the cause for this? So far, I also did not see any data duplication in the log output.

Kindest Regards,  
Moritz

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 7, 2023, 11:40am UTC](https://discuss.elastic.co/t/filebeat-k8s-deployment-duplicated-filestream-id/338008/2 "2023-08-07T11:40:30Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.