# Filebeat trying to access pvc even when no data is being written

**URL:** <https://discuss.elastic.co/t/filebeat-trying-to-access-pvc-even-when-no-data-is-being-written/381482>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [September 1, 2025, 11:19am UTC](https://discuss.elastic.co/t/filebeat-trying-to-access-pvc-even-when-no-data-is-being-written/381482 "2025-09-01T11:19:52Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Tejaswi43](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tejaswi43/32/144846_2.png) [@Tejaswi43](https://discuss.elastic.co/u/Tejaswi43)\
**Post date:** [September 1, 2025, 11:19am UTC](https://discuss.elastic.co/t/filebeat-trying-to-access-pvc-even-when-no-data-is-being-written/381482/1 "2025-09-01T11:19:52Z")

</div>

Hi,

I was facing some issue with filebeat when it was trying access pvc of some other pod in k8s env. The owner of the pvc is stuck due the pvc was not being able to unmount as filebeat is holding.

I didn’t get any concrete evidence that filebeat is holding the mount to busy but when I try to delete filebeat pod the other pod which is in stuck is getting relieved. Can someone help me out to troubleshoot this issue

---

<div class="post-metadata">

**Author:** ![Tortoise](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tortoise/32/147587_2.png) [@Tortoise](https://discuss.elastic.co/u/Tortoise)\
**Post date:** [September 2, 2025, 10:44am UTC](https://discuss.elastic.co/t/filebeat-trying-to-access-pvc-even-when-no-data-is-being-written/381482/2 "2025-09-02T10:44:27Z")

</div>

Hello @Tejaswi43

Welcome to the community!!

Could you please share the `filebeat.yml` configuration you are using? It might help pinpoint why Filebeat is interacting with the PVC.

Thanks!!

---

<div class="post-metadata">

**Author:** ![sasikiranvaddi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sasikiranvaddi/32/134584_2.png) [@sasikiranvaddi](https://discuss.elastic.co/u/sasikiranvaddi)\
**Post date:** [September 3, 2025, 8:44am UTC](https://discuss.elastic.co/t/filebeat-trying-to-access-pvc-even-when-no-data-is-being-written/381482/3 "2025-09-03T08:44:41Z")

</div>

Hi,  
We have verified that if there are any open file descriptors held by filebeat with the help of command:  
/proc/filebeat-processid/fd  
since we are using filebeat deployed as k8s pod.  
Below is the filebeat.yml being used.

[https://pad.riseup.net/p/filebeat-pvc-issue-keep](https://pad.riseup.net/p/filebeat-pvc-issue-keep "https://pad.riseup.net/p/filebeat-pvc-issue-keep")

And one more observation is the pvc is not able unmount since its busy state and if we remove the file path of that pvc from filebeat.yml we could see the pvc getting unmount.

---

<div class="post-metadata">

**Author:** ![Tejaswi43](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tejaswi43/32/144846_2.png) [@Tejaswi43](https://discuss.elastic.co/u/Tejaswi43)\
**Post date:** [September 16, 2025, 8:39am UTC](https://discuss.elastic.co/t/filebeat-trying-to-access-pvc-even-when-no-data-is-being-written/381482/4 "2025-09-16T08:39:36Z")

</div>

Hi @Tortoise above details provided by @sasikiranvaddi includes the details regarding filebeat.yml and more info regarding the issue. Please let us know if more details required to debug the issue