# Filebeat not starting log aggregation on some kubernetes worker nodes

**URL:** <https://discuss.elastic.co/t/filebeat-not-starting-log-aggregation-on-some-kubernetes-worker-nodes/265204>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [February 23, 2021, 1:26pm UTC](https://discuss.elastic.co/t/filebeat-not-starting-log-aggregation-on-some-kubernetes-worker-nodes/265204 "2021-02-23T13:26:55Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![lbenton](https://avatars.discourse-cdn.com/v4/letter/l/e9bcb4/32.png) [@lbenton](https://discuss.elastic.co/u/lbenton)\
**Post date:** [February 23, 2021, 1:26pm UTC](https://discuss.elastic.co/t/filebeat-not-starting-log-aggregation-on-some-kubernetes-worker-nodes/265204/1 "2021-02-23T13:26:55Z")

</div>

Hi All,

I've run into an issue with filebeat in kubernetes, but only on some worker nodes. If useful, here's a bit of background

-Deployed using helm, via terraform  
-currently 16 worker nodes, 7 of which filebeat refuses to process logs.  
-filebeat version 7.10.2  
-Running in AKS

Looking through the logs I'm just not able to tell why some filebeat pods work and some don't.

I've created a [gist](https://gist.github.com/lbenton/8af16441ef688bac84f78c8837da33b8) with:

- Logs from a good pod (DEBUG enabled)
- Logs from a bad pod (DEBUG enabled)
- filebeat.yaml used to deploy across all the nodes

Things I've tried:

- Destroying and recreating the EFK stack and filebeat
- Wiping the beats-data persistence storage location on worker nodes for both working and non-working filebeat pods
- Rebooting
- Verified logs are mounted and readable from within the pods

This will sound crazy but the only common thread I can find is that the filebeat pods that are not working are all on worker nodes whose name ends in a letter. I think it's coincidental but thought I'd mention it.

Thanks in advance for any help. I do appreciate it.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 23, 2021, 3:27pm UTC](https://discuss.elastic.co/t/filebeat-not-starting-log-aggregation-on-some-kubernetes-worker-nodes/265204/2 "2021-03-23T15:27:28Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.