# Filebeat OSS 9.1.2 crashes with segmentation fault #46016

**URL:** <https://discuss.elastic.co/t/filebeat-oss-9-1-2-crashes-with-segmentation-fault-46016/381056>\
**Category:** Beats\
**Tags:** docker, filebeat\
**Created:** [August 14, 2025, 6:19pm UTC](https://discuss.elastic.co/t/filebeat-oss-9-1-2-crashes-with-segmentation-fault-46016/381056 "2025-08-14T18:19:24Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![nimayz](https://avatars.discourse-cdn.com/v4/letter/n/b4bc9f/32.png) [@nimayz](https://discuss.elastic.co/u/nimayz)\
**Post date:** [August 14, 2025, 6:19pm UTC](https://discuss.elastic.co/t/filebeat-oss-9-1-2-crashes-with-segmentation-fault-46016/381056/1 "2025-08-14T18:19:24Z")

</div>

Filebeat 9.1.2 crashes when running in a docker container. I’m running this on an M1 Mac.

```auto
$ docker run --rm -ti --entrypoint bash docker.elastic.co/beats/filebeat-oss:9.1.2 $ ./filebeat Segmentation fault 

```

Cannot reproduce with `docker.elastic.co/beats/filebeat-oss:9.1.1`. Also when I run go version -m on the filebeat process I get `could not read Go build info from filebeat: unrecognized file format`.

---

<div class="post-metadata">

**Author:** ![TiagoQueiroz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tiagoqueiroz/32/107061_2.png) [@TiagoQueiroz](https://discuss.elastic.co/u/TiagoQueiroz)\
**Post date:** [August 14, 2025, 6:46pm UTC](https://discuss.elastic.co/t/filebeat-oss-9-1-2-crashes-with-segmentation-fault-46016/381056/2 "2025-08-14T18:46:38Z")

</div>

Hi @nimayz, that looks like a platform miss match, I’ve just tried the command you posted on a ARM Mac (M1 Max) and it works:

```auto
125:125 tiago@Not-A-Linux~ % docker run --rm -ti --entrypoint bash docker.elastic.co/beats/filebeat-oss:9.1.2                 
bash-5.1$ ./filebeat -e   
{"log.level":"info","@timestamp":"2025-08-14T18:39:26.727Z","log.origin":{"function":"github.com/elastic/beats/v7/libbeat/cmd/instance.(*Beat).configure","file.name":"instance/beat.go","file.line":826},"message":"Home path: [/usr/share/filebeat] Config path: [/usr/share/filebeat] Data path: [/usr/share/filebeat/data] Logs path: [/usr/share/filebeat/logs]","service.name":"filebeat","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2025-08-14T18:39:26.734Z","log.origin":{"function":"github.com/elastic/beats/v7/libbeat/cmd/instance.(*Beat).configure","file.name":"instance/beat.go","file.line":834},"message":"Beat ID: af61e8be-9daf-448b-87f2-207310549af3","service.name":"filebeat","ecs.version":"1.6.0"}
^C
bash-5.1$ exit
exit
130:INT tiago@Not-A-Linux~ % 

```

Could you run the following commands and check the architecture:

```auto
% docker run --rm --name filebeat -d docker.elastic.co/beats/filebeat-oss:9.1.2
6fd43a0f1eda91344290b2810fa6ff88fb94b051fc5f492fb32c54e8428bde3d
% docker inspect filebeat |grep -i architecture                                 
                "architecture": "aarch64",

```

---

<div class="post-metadata">

**Author:** ![nimayz](https://avatars.discourse-cdn.com/v4/letter/n/b4bc9f/32.png) [@nimayz](https://discuss.elastic.co/u/nimayz)\
**Post date:** [August 14, 2025, 7:19pm UTC](https://discuss.elastic.co/t/filebeat-oss-9-1-2-crashes-with-segmentation-fault-46016/381056/3 "2025-08-14T19:19:10Z")

</div>

> [@TiagoQueiroz](#):
>
> `ocker inspect filebeat |grep -i architecture `

@TiagoQueiroz Thanks for getting back to me. I also get the following result. `"architecture": "aarch64",`. One thing I’ll add is I’m using Colima as my container runtime.

---

<div class="post-metadata">

**Author:** ![TiagoQueiroz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tiagoqueiroz/32/107061_2.png) [@TiagoQueiroz](https://discuss.elastic.co/u/TiagoQueiroz)\
**Post date:** [August 14, 2025, 8:02pm UTC](https://discuss.elastic.co/t/filebeat-oss-9-1-2-crashes-with-segmentation-fault-46016/381056/4 "2025-08-14T20:02:48Z")

</div>

I’m confused now… The commands you showed are using `docker`. After all, which container runtime are you using?

Also, could you try running:

```auto
docker run --rm docker.elastic.co/beats/filebeat-oss:9.1.2 -e -d "*"

```

And pasting here all the logs? I want to understand if Filebeat is at least starting.

Also, how did you run `go version -m` on the binary if we don’t ship the Go toolchain in the docker image?

---

<div class="post-metadata">

**Author:** ![nimayz](https://avatars.discourse-cdn.com/v4/letter/n/b4bc9f/32.png) [@nimayz](https://discuss.elastic.co/u/nimayz)\
**Post date:** [August 14, 2025, 8:25pm UTC](https://discuss.elastic.co/t/filebeat-oss-9-1-2-crashes-with-segmentation-fault-46016/381056/5 "2025-08-14T20:25:13Z")

</div>

Sorry for the confusion. I’m using the docker client and running docker server within Colima which replaces docker desktop on Mac.

```auto
$ colima status
INFO[0004] colima is running using QEMU
INFO[0004] arch: aarch64
INFO[0004] runtime: docker
INFO[0004] mountType: sshfs

```

I get the following when I run the command which is empty. The container exists with exist code 139.

```auto
$ docker run --rm ``docker.elastic.co/beats/filebeat-oss:9.1.2`` -e -d "*"
$ $?
zsh: command not found: 139

```

I copied the filebeat process onto my machine and ran the go command on it. (It works fine for any other version of filebeat).

This is the result when I run the command on the filebeat binary I retrieved from the filebeat and filebeat-oss image respectively

```auto
$ file fb/filebeat
fb/filebeat: ELF 64-bit LSB pie executable, ARM aarch64, version 1 (SYSV), dynamically linked, interpreter /lib/ld-linux-aarch64.so.1, for GNU/Linux 3.7.0, Go BuildID=1ufOxIOS-3mEHsPQKIwg/tmGWwjLFlxBrnQUr2oUN/NFIqo40dxg1MrzZjuI_f/T8OAv5yKFzP2yu3Q4OiI, BuildID[sha1]=49333e9cfcc47ed35177d5813bbd72062bf64947, stripped
$ file fb/filebeat-oss
fb/filebeat-oss: ELF 64-bit LSB shared object, ARM aarch64, version 1 (SYSV), dynamically linked, interpreter /lib/ld-linux-aarch64.so.1, missing section headers at 139190248

$ go version fb/filebeatfb/filebeat: go1.24.4
$ go version fb/filebeat-ossfb/filebeat-oss: could not read Go build info from fb/filebeat-oss: unrecognized file format

```

---

<div class="post-metadata">

**Author:** ![TiagoQueiroz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tiagoqueiroz/32/107061_2.png) [@TiagoQueiroz](https://discuss.elastic.co/u/TiagoQueiroz)\
**Post date:** [August 14, 2025, 9:03pm UTC](https://discuss.elastic.co/t/filebeat-oss-9-1-2-crashes-with-segmentation-fault-46016/381056/6 "2025-08-14T21:03:54Z")

</div>

@nimayz Have you tried using the official Docker runtime?

---

<div class="post-metadata">

**Author:** ![nimayz](https://avatars.discourse-cdn.com/v4/letter/n/b4bc9f/32.png) [@nimayz](https://discuss.elastic.co/u/nimayz)\
**Post date:** [August 14, 2025, 9:29pm UTC](https://discuss.elastic.co/t/filebeat-oss-9-1-2-crashes-with-segmentation-fault-46016/381056/7 "2025-08-14T21:29:18Z")

</div>

> [@TiagoQueiroz](#):
>
> `docker run --rm docker.elastic.co/beats/filebeat-oss:9.1.2 -e -d "*"`

@TiagoQueiroz I’ve had a few of my colleages try this on both colima and docker desktop and non see the issue I’m seeing. I think this is only happening on my laptop. Thanks for your help. This is good to resolve.