Filebeat trying to access pvc even when no data is being written

Elastic Stack Beats
1

Hi,

I was facing some issue with filebeat when it was trying access pvc of some other pod in k8s env. The owner of the pvc is stuck due the pvc was not being able to unmount as filebeat is holding.

I didn’t get any concrete evidence that filebeat is holding the mount to busy but when I try to delete filebeat pod the other pod which is in stuck is getting relieved. Can someone help me out to troubleshoot this issue

2

Hello @Tejaswi43

Welcome to the community!!

Could you please share the filebeat.yml configuration you are using? It might help pinpoint why Filebeat is interacting with the PVC.

Thanks!!

3

Hi,
We have verified that if there are any open file descriptors held by filebeat with the help of command:
/proc/filebeat-processid/fd
since we are using filebeat deployed as k8s pod.
Below is the filebeat.yml being used.

https://pad.riseup.net/p/filebeat-pvc-issue-keep

And one more observation is the pvc is not able unmount since its busy state and if we remove the file path of that pvc from filebeat.yml we could see the pvc getting unmount.

4

Hi @Tortoise above details provided by @sasikiranvaddi includes the details regarding filebeat.yml and more info regarding the issue. Please let us know if more details required to debug the issue