# Filebeat logs /tmp/filebeat.{host}.root.log.INFO.{date}

**URL:** https://discuss.elastic.co/t/filebeat-logs-tmp-filebeat-host-root-log-info-date/239607
**Category:** Beats
**Tags:** docker, filebeat
**Created:** [July 2, 2020, 10:23am UTC](https://discuss.elastic.co/t/filebeat-logs-tmp-filebeat-host-root-log-info-date/239607 "2020-07-02T10:23:34Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![phivos](https://avatars.discourse-cdn.com/v4/letter/p/ea5d25/32.png) [@phivos](https://discuss.elastic.co/u/phivos)
#### Post date: [July 2, 2020, 10:23am UTC](https://discuss.elastic.co/t/filebeat-logs-tmp-filebeat-host-root-log-info-date/239607/1 "2020-07-02T10:23:34Z")

</div>

Same case with this [closed topic](https://discuss.elastic.co/t/beats-generate-files-under-tmp/224231)

Filebeat is deployed on a kubernetes cluster as daemon set, and generates thousands of files under /tmp.

This caused extremely high inode usage preventing the system from being able to deploy pods on the node.

I tried disabling logging to no avail.

```auto
filebeat.yml
    queue.mem:
      events: 4096
      flush.min_events: 512
      flush.timeout: 5s
    filebeat.inputs:
    - type: container
      paths: 
        - '/var/lib/docker/containers/*/*.log'
      json.keys_under_root: true
      json.ignore_decoding_error: true
      ignore_older: 48h
      close_inactive: 24h
    processors:
    - add_kubernetes_metadata:
        host: ${HOSTNAME}
    - decode_json_fields:
        when.regexp.message: "^{.*}$"
        fields: ["message"]
        process_array: true
        max_depth: 3
    - dissect:
        when:
          and:
            - has_fields: ['kubernetes.namespace']
            - equals.kubernetes.namespace: "ingress"
        tokenizer: "%{remote_addr} - [%{remote_user}] - - [%{time_local}] \"%{request}\" %{status} %{body_bytes_sent} \"%{http_referer}\" \"%{http_user_agent}\" %{request_length} %{request_time} [%{proxy_upstream_name}] %{upstream_addr} %{upstream_response_length} %{upstream_response_time} %{upstream_status} %{req_id}"
        field: "message"
        target_prefix: "data"
    - convert:
        when.not.has_fields: ['timestamp']
        fields:
          - {from: "@timestamp", to: "timestamp"}
    - convert:
        fields:
          - {from: "kubernetes.container.name", to: "kubernetes.container_name"}
          - {from: "kubernetes.container.image", to: "kubernetes.container_image"}
          - {from: "kubernetes.pod.name", to: "kubernetes.pod_name"}
          - {from: "kubernetes.node.name", to: "kubernetes.host"}
          - {from: "kubernetes.namespace", to: "kubernetes.namespace_name"}
        fail_on_error: false
    - drop_fields:
        fields: 
          - host
          - agent
          - input
          - ecs
          - log
          - stream
          - json
          - kubernetes.pod
          - kubernetes.container
          - kubernetes.replicaset
          - kubernetes.namespace
          - kubernetes.node
        ignore_missing: true
    logging.json: true
    logging.level: error
    logging.to_files: false
    setup.ilm.enabled: false
    setup.template.enabled: false
    setup.template.overwrite: false
    setup.template.pattern: ""
    setup.template.name: ""
    output:
      elasticsearch:
        hosts: ["${ELASTICSEARCH_URL}"]
        username: '${ELASTICSEARCH_USERNAME}'
        password: '${ELASTICSEARCH_PASSWORD}'
        indices:
          - index: "${INDEX_PREFIX}.%{[kubernetes.namespace_name]}.%{+yyyy.MM.dd}"

```

---

<div class="post-metadata">

### Author: ![phivos](https://avatars.discourse-cdn.com/v4/letter/p/ea5d25/32.png) [@phivos](https://discuss.elastic.co/u/phivos)
#### Post date: [July 2, 2020, 1:26pm UTC](https://discuss.elastic.co/t/filebeat-logs-tmp-filebeat-host-root-log-info-date/239607/2 "2020-07-02T13:26:40Z")

</div>

seems to be exactly the same issue as the previous post, if i comment out the `add_kubernetes_metadata` processor the log files are not created.

---

<div class="post-metadata">

### Author: ![phivos](https://avatars.discourse-cdn.com/v4/letter/p/ea5d25/32.png) [@phivos](https://discuss.elastic.co/u/phivos)
#### Post date: [July 2, 2020, 3:31pm UTC](https://discuss.elastic.co/t/filebeat-logs-tmp-filebeat-host-root-log-info-date/239607/3 "2020-07-02T15:31:37Z")

</div>

this is somehow related to this issue

> <https://github.com/elastic/beats/issues/18961>
>
> With #18817 we upgraded the dependency to k8s.io/client-go which resulted in having some warnings of the client now coming in the...

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 30, 2020, 5:31pm UTC](https://discuss.elastic.co/t/filebeat-logs-tmp-filebeat-host-root-log-info-date/239607/4 "2020-07-30T17:31:40Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.