Filebeat panic in Windows nano server container

Elastic Stack Beats
,
1

Filebeat 7.7 panic in Windows nano server container, however 7.3 works.
Found a useful link: https://github.com/golang/go/issues/21867, latest klog fixed it: https://github.com/kubernetes/klog/blob/master/klog_file.go#L62

Dockerfile

FROM mcr.microsoft.com/windows/nanoserver:1809
COPY . /app/

docker build -t fb:v1 .
docker run -it --rm fb:v1 cmd

C:\app>filebeat-7.3.exe
Exiting: error loading config file: open filebeat.yml: The system cannot find the file specified.

C:\app>filebeat-7.7.exe
panic: Failed to load netapi32.dll: The specified module could not be found.

goroutine 1 [running]:
syscall.(*LazyProc).mustFind(0xc000083920)
/usr/local/go/src/syscall/dll_windows.go:311 +0x5f
syscall.(*LazyProc).Addr(0xc000083920, 0x1a)
/usr/local/go/src/syscall/dll_windows.go:318 +0x32
syscall.NetGetJoinInformation(0x0, 0xc0002dda00, 0xc0002dd9fc, 0xd, 0xc000385080)
/usr/local/go/src/syscall/zsyscall_windows.go:1804 +0x38
os/user.isDomainJoined(0xc0002dda58, 0x44b72e, 0x0)
/usr/local/go/src/os/user/lookup_windows.go:18 +0x5a
os/user.lookupFullName(0xc0003f25f0, 0xc, 0xc0003f25e0, 0xd, 0xc000385080, 0x1a, 0xd, 0xc000385080, 0x1a, 0x1)
/usr/local/go/src/os/user/lookup_windows.go:55 +0x2d
os/user.newUser(0xc0003f25b0, 0xc, 0xc0003f25d0, 0xc, 0xc000385040, 0x16, 0xc0003f25e0, 0xd, 0xc0003f25f0, 0xc, ...)
/usr/local/go/src/os/user/lookup_windows.go:186 +0xd4
os/user.current(0x0, 0x0, 0x0)
/usr/local/go/src/os/user/lookup_windows.go:230 +0x2bd
os/user.Current.func1()
/usr/local/go/src/os/user/lookup.go:15 +0x29
sync.(*Once).doSlow(0x463c900, 0x292a030)
/usr/local/go/src/sync/once.go:66 +0xea
sync.(*Once).Do(...)
/usr/local/go/src/sync/once.go:57
os/user.Current(0xc0003f25a0, 0xc, 0x2804065)
/usr/local/go/src/os/user/lookup.go:15 +0xf9
k8s.io/klog.init.1()
/go/src/github.com/elastic/beats/vendor/k8s.io/klog/klog_file.go:58 +0x48

2

Hi @zhiweiv!

Thanks for reporting this! Could you please file a github issue for this case in order to be scheduled to be fixed?

In the meantime I would suggest you removing add_kubernetes_metadata processor from your configuration in order to avoid having this issue. Let me know if that helps!

C.

3

Issue commited, https://github.com/elastic/beats/issues/19185.
Removing add_kubernetes_metadata processor may not work, because I didn't specify any config file, the error occurred at klog init, if everything works well, it should output "Exiting: error loading config file: open filebeat.yml: The system cannot find the file specified." like filebeat 7.3 did.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.