# \[Filebeat\] K8s OOM kill causes file corruption

**URL:** <https://discuss.elastic.co/t/filebeat-k8s-oom-kill-causes-file-corruption/252734>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [October 20, 2020, 8:11pm UTC](https://discuss.elastic.co/t/filebeat-k8s-oom-kill-causes-file-corruption/252734 "2020-10-20T20:11:02Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![boernd](https://avatars.discourse-cdn.com/v4/letter/b/3e96dc/32.png) [@boernd](https://discuss.elastic.co/u/boernd)\
**Post date:** [October 20, 2020, 8:11pm UTC](https://discuss.elastic.co/t/filebeat-k8s-oom-kill-causes-file-corruption/252734/1 "2020-10-20T20:11:02Z")

</div>

Hi,

I have the following issue and think it's a bug but wanted to post here before filing a Github issue:

A filebeat container gets killed/restarted because of memory limits within K8s. After the container restart the following log appears and no events are sent from this filebeat pod anymore:

```auto
{"level":"warn","timestamp":"2020-10-20T18:21:56.116Z","caller":"memlog/store.go:130","message":"Incomplete or corrupted log file in /usr/share/filebeat/data/xyz/filebeat. Continue with last known complete and consistent state. Reason: unexpected EOF"}

```

A pod restart resolves the issue though.

Filebeat version 7.9.2 with Logstash output. For log collection I use the Kubernetes autodiscover feature.

Regards  
Bernd

---

<div class="post-metadata">

**Author:** ![shaunak](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shaunak/32/6643_2.png) [@shaunak](https://discuss.elastic.co/u/shaunak)\
**Post date:** [October 21, 2020, 3:06am UTC](https://discuss.elastic.co/t/filebeat-k8s-oom-kill-causes-file-corruption/252734/2 "2020-10-21T03:06:49Z")

</div>

Hmmm, as indicated in the log line this is a warning and it _shouldn't_ affect the operation of Filebeat. Would you mind reproducing this issue but with Filebeat logging level set to debug (by setting `logging.level: debug` in the Filebeat configuration)? And then please post the logs from about 15 seconds before the warning log line through 15 seconds after.

Thanks,

Shaunak

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 18, 2020, 5:07am UTC](https://discuss.elastic.co/t/filebeat-k8s-oom-kill-causes-file-corruption/252734/3 "2020-11-18T05:07:02Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.