Filebeat OSS 9.1.2 crashes with segmentation fault #46016

Elastic Stack Beats
,
1

Filebeat 9.1.2 crashes when running in a docker container. I’m running this on an M1 Mac.

$ docker run --rm -ti --entrypoint bash docker.elastic.co/beats/filebeat-oss:9.1.2 $ ./filebeat Segmentation fault

Cannot reproduce with docker.elastic.co/beats/filebeat-oss:9.1.1. Also when I run go version -m on the filebeat process I get could not read Go build info from filebeat: unrecognized file format.

2

Hi @nimayz, that looks like a platform miss match, I’ve just tried the command you posted on a ARM Mac (M1 Max) and it works:

125:125 tiago@Not-A-Linux~ % docker run --rm -ti --entrypoint bash docker.elastic.co/beats/filebeat-oss:9.1.2                 
bash-5.1$ ./filebeat -e   
{"log.level":"info","@timestamp":"2025-08-14T18:39:26.727Z","log.origin":{"function":"github.com/elastic/beats/v7/libbeat/cmd/instance.(*Beat).configure","file.name":"instance/beat.go","file.line":826},"message":"Home path: [/usr/share/filebeat] Config path: [/usr/share/filebeat] Data path: [/usr/share/filebeat/data] Logs path: [/usr/share/filebeat/logs]","service.name":"filebeat","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2025-08-14T18:39:26.734Z","log.origin":{"function":"github.com/elastic/beats/v7/libbeat/cmd/instance.(*Beat).configure","file.name":"instance/beat.go","file.line":834},"message":"Beat ID: af61e8be-9daf-448b-87f2-207310549af3","service.name":"filebeat","ecs.version":"1.6.0"}
^C
bash-5.1$ exit
exit
130:INT tiago@Not-A-Linux~ %

Could you run the following commands and check the architecture:

% docker run --rm --name filebeat -d  docker.elastic.co/beats/filebeat-oss:9.1.2
6fd43a0f1eda91344290b2810fa6ff88fb94b051fc5f492fb32c54e8428bde3d
% docker inspect filebeat |grep -i architecture                                 
                "architecture": "aarch64",
3

@TiagoQueiroz Thanks for getting back to me. I also get the following result. "architecture": "aarch64",. One thing I’ll add is I’m using Colima as my container runtime.

4

I’m confused now… The commands you showed are using docker. After all, which container runtime are you using?

Also, could you try running:

docker run --rm docker.elastic.co/beats/filebeat-oss:9.1.2 -e -d "*"

And pasting here all the logs? I want to understand if Filebeat is at least starting.

Also, how did you run go version -m on the binary if we don’t ship the Go toolchain in the docker image?

5

Sorry for the confusion. I’m using the docker client and running docker server within Colima which replaces docker desktop on Mac.

$ colima status
INFO[0004] colima is running using QEMU
INFO[0004] arch: aarch64
INFO[0004] runtime: docker
INFO[0004] mountType: sshfs

I get the following when I run the command which is empty. The container exists with exist code 139.

$  docker run --rm ``docker.elastic.co/beats/filebeat-oss:9.1.2`` -e -d "*"
$ $?
zsh: command not found: 139

I copied the filebeat process onto my machine and ran the go command on it. (It works fine for any other version of filebeat).

This is the result when I run the command on the filebeat binary I retrieved from the filebeat and filebeat-oss image respectively

$ file fb/filebeat
fb/filebeat: ELF 64-bit LSB pie executable, ARM aarch64, version 1 (SYSV), dynamically linked, interpreter /lib/ld-linux-aarch64.so.1, for GNU/Linux 3.7.0, Go BuildID=1ufOxIOS-3mEHsPQKIwg/tmGWwjLFlxBrnQUr2oUN/NFIqo40dxg1MrzZjuI_f/T8OAv5yKFzP2yu3Q4OiI, BuildID[sha1]=49333e9cfcc47ed35177d5813bbd72062bf64947, stripped
$ file fb/filebeat-oss
fb/filebeat-oss: ELF 64-bit LSB shared object, ARM aarch64, version 1 (SYSV), dynamically linked, interpreter /lib/ld-linux-aarch64.so.1, missing section headers at 139190248

$ go version fb/filebeatfb/filebeat: go1.24.4
$ go version fb/filebeat-ossfb/filebeat-oss: could not read Go build info from fb/filebeat-oss: unrecognized file format
6

@nimayz Have you tried using the official Docker runtime?

7

@TiagoQueiroz I’ve had a few of my colleages try this on both colima and docker desktop and non see the issue I’m seeing. I think this is only happening on my laptop. Thanks for your help. This is good to resolve.

1 Like