Filebeat Kubernetes autodiscover provider is getting failed with "/var/run/secrets/kubernetes.io/serviceaccount/namespace: no such file or directory" Error

[Debashis (Debashis Mondal)]

Hi - I am using following configuration to autodiscover filebeat pods

filebeat.autodiscover:
providers:
- type: kubernetes
templates:
- condition:
equals:
kubernetes.namespace: default
config:
- type: docker
containers.ids:
- "${data.kubernetes.container.id}"

I am getting below issue. Please help me to resolve.
"Exiting: Unable to get in cluster configuration: open /var/run/secrets/kubernetes.io/serviceaccount/namespace: no such file or directory"

Thanks

[MarianaD]

hi @Debashis, the kubernetes autodiscover provider expects to be running inside the cluster, is this the current situation?

[Debashis (Debashis Mondal)]

No @MarianaD. Filebeat is running on host machine where kubernetes is installed. It is not running inside a pod.

[exekias (Carlos Pérez Aradros)]

Hi @Debashis,

Filebeat kubernetes autodiscover provider will try to autoconfigure itself when run inside Kubernetes. As you are running it from the host, you need to pass certain parameters to make it work. Docs are here: https://www.elastic.co/guide/en/beats/filebeat/current/configuration-autodiscover.html#_kubernetes

You will basically need to provide kube_config, pointing to the kubernetes client config file to connect to the cluster. host may also be needed, to be set to the name of the node in the cluster, probably host: ${HOSTNAME} will do.

Best regards