# Filebeat panic in Windows nano server container

**URL:** <https://discuss.elastic.co/t/filebeat-panic-in-windows-nano-server-container/236838>\
**Category:** Beats\
**Tags:** docker, filebeat\
**Created:** [June 12, 2020, 6:57am UTC](https://discuss.elastic.co/t/filebeat-panic-in-windows-nano-server-container/236838 "2020-06-12T06:57:18Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![zhiweiv](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zhiweiv/32/70217_2.png) [@zhiweiv](https://discuss.elastic.co/u/zhiweiv)\
**Post date:** [June 12, 2020, 6:57am UTC](https://discuss.elastic.co/t/filebeat-panic-in-windows-nano-server-container/236838/1 "2020-06-12T06:57:18Z")

</div>

Filebeat 7.7 panic in Windows nano server container, however 7.3 works.  
Found a useful link: [https://github.com/golang/go/issues/21867](https://github.com/golang/go/issues/21867), latest klog fixed it: [https://github.com/kubernetes/klog/blob/master/klog\_file.go#L62](https://github.com/kubernetes/klog/blob/master/klog_file.go#L62)

Dockerfile

```auto
FROM mcr.microsoft.com/windows/nanoserver:1809
COPY . /app/

```

docker build -t fb:v1 .  
docker run -it --rm fb:v1 cmd

C:\app\>filebeat-7.3.exe  
Exiting: error loading config file: open filebeat.yml: The system cannot find the file specified.

C:\app\>filebeat-7.7.exe  
panic: Failed to load netapi32.dll: The specified module could not be found.

goroutine 1 [running]:  
syscall.(\*LazyProc).mustFind(0xc000083920)  
/usr/local/go/src/syscall/dll\_windows.go:311 +0x5f  
syscall.(\*LazyProc).Addr(0xc000083920, 0x1a)  
/usr/local/go/src/syscall/dll\_windows.go:318 +0x32  
syscall.NetGetJoinInformation(0x0, 0xc0002dda00, 0xc0002dd9fc, 0xd, 0xc000385080)  
/usr/local/go/src/syscall/zsyscall\_windows.go:1804 +0x38  
os/user.isDomainJoined(0xc0002dda58, 0x44b72e, 0x0)  
/usr/local/go/src/os/user/lookup\_windows.go:18 +0x5a  
os/user.lookupFullName(0xc0003f25f0, 0xc, 0xc0003f25e0, 0xd, 0xc000385080, 0x1a, 0xd, 0xc000385080, 0x1a, 0x1)  
/usr/local/go/src/os/user/lookup\_windows.go:55 +0x2d  
os/user.newUser(0xc0003f25b0, 0xc, 0xc0003f25d0, 0xc, 0xc000385040, 0x16, 0xc0003f25e0, 0xd, 0xc0003f25f0, 0xc, ...)  
/usr/local/go/src/os/user/lookup\_windows.go:186 +0xd4  
os/user.current(0x0, 0x0, 0x0)  
/usr/local/go/src/os/user/lookup\_windows.go:230 +0x2bd  
os/user.Current.func1()  
/usr/local/go/src/os/user/lookup.go:15 +0x29  
sync.(\*Once).doSlow(0x463c900, 0x292a030)  
/usr/local/go/src/sync/once.go:66 +0xea  
sync.(\*Once).Do(...)  
/usr/local/go/src/sync/once.go:57  
os/user.Current(0xc0003f25a0, 0xc, 0x2804065)  
/usr/local/go/src/os/user/lookup.go:15 +0xf9  
[k8s.io/klog.init.1()](http://k8s.io/klog.init.1())  
/go/src/github.com/elastic/beats/vendor/k8s.io/klog/klog\_file.go:58 +0x48

---

<div class="post-metadata">

**Author:** ![ChrsMark](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/chrsmark/32/55858_2.png) [@ChrsMark](https://discuss.elastic.co/u/ChrsMark)\
**Post date:** [June 12, 2020, 8:06am UTC](https://discuss.elastic.co/t/filebeat-panic-in-windows-nano-server-container/236838/2 "2020-06-12T08:06:59Z")

</div>

Hi @zhiweiv!

Thanks for reporting this! Could you please file a github issue for this case in order to be scheduled to be fixed?

In the meantime I would suggest you removing `add_kubernetes_metadata` processor from your configuration in order to avoid having this issue. Let me know if that helps!

C.

---

<div class="post-metadata">

**Author:** ![zhiweiv](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zhiweiv/32/70217_2.png) [@zhiweiv](https://discuss.elastic.co/u/zhiweiv)\
**Post date:** [June 15, 2020, 1:49am UTC](https://discuss.elastic.co/t/filebeat-panic-in-windows-nano-server-container/236838/3 "2020-06-15T01:49:18Z")

</div>

Issue commited, [https://github.com/elastic/beats/issues/19185](https://github.com/elastic/beats/issues/19185).  
Removing `add_kubernetes_metadata` processor may not work, because I didn't specify any config file, the error occurred at klog init, if everything works well, it should output "Exiting: error loading config file: open filebeat.yml: The system cannot find the file specified." like filebeat 7.3 did.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 13, 2020, 3:49am UTC](https://discuss.elastic.co/t/filebeat-panic-in-windows-nano-server-container/236838/4 "2020-07-13T03:49:19Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.