Filebeat panic in Windows nano server container

Filebeat 7.7 panic in Windows nano server container, however 7.3 works.
Found a useful link:, latest klog fixed it:


COPY . /app/

docker build -t fb:v1 .
docker run -it --rm fb:v1 cmd

Exiting: error loading config file: open filebeat.yml: The system cannot find the file specified.

panic: Failed to load netapi32.dll: The specified module could not be found.

goroutine 1 [running]:
/usr/local/go/src/syscall/dll_windows.go:311 +0x5f
syscall.(*LazyProc).Addr(0xc000083920, 0x1a)
/usr/local/go/src/syscall/dll_windows.go:318 +0x32
syscall.NetGetJoinInformation(0x0, 0xc0002dda00, 0xc0002dd9fc, 0xd, 0xc000385080)
/usr/local/go/src/syscall/zsyscall_windows.go:1804 +0x38
os/user.isDomainJoined(0xc0002dda58, 0x44b72e, 0x0)
/usr/local/go/src/os/user/lookup_windows.go:18 +0x5a
os/user.lookupFullName(0xc0003f25f0, 0xc, 0xc0003f25e0, 0xd, 0xc000385080, 0x1a, 0xd, 0xc000385080, 0x1a, 0x1)
/usr/local/go/src/os/user/lookup_windows.go:55 +0x2d
os/user.newUser(0xc0003f25b0, 0xc, 0xc0003f25d0, 0xc, 0xc000385040, 0x16, 0xc0003f25e0, 0xd, 0xc0003f25f0, 0xc, ...)
/usr/local/go/src/os/user/lookup_windows.go:186 +0xd4
os/user.current(0x0, 0x0, 0x0)
/usr/local/go/src/os/user/lookup_windows.go:230 +0x2bd
/usr/local/go/src/os/user/lookup.go:15 +0x29
sync.(*Once).doSlow(0x463c900, 0x292a030)
/usr/local/go/src/sync/once.go:66 +0xea
os/user.Current(0xc0003f25a0, 0xc, 0x2804065)
/usr/local/go/src/os/user/lookup.go:15 +0xf9
/go/src/ +0x48

Hi @zhiweiv!

Thanks for reporting this! Could you please file a github issue for this case in order to be scheduled to be fixed?

In the meantime I would suggest you removing add_kubernetes_metadata processor from your configuration in order to avoid having this issue. Let me know if that helps!


Issue commited,
Removing add_kubernetes_metadata processor may not work, because I didn't specify any config file, the error occurred at klog init, if everything works well, it should output "Exiting: error loading config file: open filebeat.yml: The system cannot find the file specified." like filebeat 7.3 did.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.