# Fillebeat keeps restarting in Kuberneates

**URL:** https://discuss.elastic.co/t/fillebeat-keeps-restarting-in-kuberneates/309702
**Category:** Beats
**Tags:** filebeat
**Created:** [July 15, 2022, 5:51am UTC](https://discuss.elastic.co/t/fillebeat-keeps-restarting-in-kuberneates/309702 "2022-07-15T05:51:16Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![Jehutywong](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jehutywong/32/50527_2.png) [@Jehutywong](https://discuss.elastic.co/u/Jehutywong)
#### Post date: [July 15, 2022, 5:51am UTC](https://discuss.elastic.co/t/fillebeat-keeps-restarting-in-kuberneates/309702/1 "2022-07-15T05:51:16Z")

</div>

Filebeat Version: 8.3.2 (image gets from [docker.elastic.co/beats/filebeat:8.3.2](http://docker.elastic.co/beats/filebeat:8.3.2))

I have roughly 40k logs in an NFS folder for Filebeat to collect. The Pod keeps restart itself in every ~10 minutes. And showing this error:

```auto
panic: reflect.Select: too many cases (max 65536)

goroutine 258 [running]:
reflect.Select({0xc0e5f7a000?, 0x10001?, 0x14124?})
	/usr/local/go/src/reflect/value.go:2793 +0x79a
github.com/elastic/beats/v7/libbeat/publisher/pipeline.(*Pipeline).runSignalPropagation(0xc0010827b8?)
	/go/src/github.com/elastic/beats/libbeat/publisher/pipeline/pipeline.go:329 +0x1d8
created by github.com/elastic/beats/v7/libbeat/publisher/pipeline.(*Pipeline).registerSignalPropagation.func1
	/go/src/github.com/elastic/beats/libbeat/publisher/pipeline/pipeline.go:314 +0x96

```

I believe i have enough Memory, hundreds of GB. ulimit shows:

```auto
# ulimit -a
core file size (blocks, -c) unlimited
data seg size (kbytes, -d) unlimited
scheduling priority (-e) 0
file size (blocks, -f) unlimited
pending signals (-i) 3095242
max locked memory (kbytes, -l) 64
max memory size (kbytes, -m) unlimited
open files (-n) 1048576
pipe size (512 bytes, -p) 8
POSIX message queues (bytes, -q) 819200
real-time priority (-r) 0
stack size (kbytes, -s) 8192
cpu time (seconds, -t) unlimited
max user processes (-u) unlimited
virtual memory (kbytes, -v) unlimited
file locks (-x) unlimited

```

Here is my filebeat.yaml inputs:

```auto
- type: filestream

  # Change to true to enable this input configuration.
  enabled: true

  # Paths that should be crawled and fetched. Glob based paths.
  paths:
    - /mnt/*

  encoding: utf-8
  close_inactive: 1m
  tail_files: true
  file_identity.path: ~

```

Any hint? Thanks

FYI, this is similar to this case

> [@Filebeat is leaking memory](https://discuss.elastic.co/t/filebeat-is-leaking-memory/291528):
>
> There are about 100,000 log files on the VM, the characteristics of the VM OS Windows Server 2019, CPU 4, RAM 4GB. To collect logs and then send them to logstash, filebeat 7.16.0 is used. After starting filebeat, it begins to consume RAM memory to the maximum, as a result, the filebeat service stops, collecting logs ends with an error: ERROR [logstash] logstash/async.go:280 Failed to publish events caused by: write tcp 10.0.10.5:53536-\>10.0.10.6:5044: wsasend: An existing connection was forcibl…

---

<div class="post-metadata">

### Author: ![Jehutywong](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jehutywong/32/50527_2.png) [@Jehutywong](https://discuss.elastic.co/u/Jehutywong)
#### Post date: [August 9, 2022, 2:51pm UTC](https://discuss.elastic.co/t/fillebeat-keeps-restarting-in-kuberneates/309702/2 "2022-08-09T14:51:10Z")

</div>

anyone?

---

<div class="post-metadata">

### Author: ![jsoriano](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jsoriano/32/27920_2.png) [@jsoriano](https://discuss.elastic.co/u/jsoriano)
#### Post date: [August 22, 2022, 3:05pm UTC](https://discuss.elastic.co/t/fillebeat-keeps-restarting-in-kuberneates/309702/3 "2022-08-22T15:05:32Z")

</div>

Hi,

There is an issue about reading from several thousands of files, it was closed, I have reopened it: [https://github.com/elastic/beats/issues/16076](https://github.com/elastic/beats/issues/16076)

In the comments there is a trace that looks like yours.

---

<div class="post-metadata">

### Author: ![Jehutywong](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jehutywong/32/50527_2.png) [@Jehutywong](https://discuss.elastic.co/u/Jehutywong)
#### Post date: [August 22, 2022, 4:01pm UTC](https://discuss.elastic.co/t/fillebeat-keeps-restarting-in-kuberneates/309702/4 "2022-08-22T16:01:33Z")

</div>

Thanks @jsoriano. Yea, the log is similar.

One more clue, the same configuration worked fine when I was running Filebeat in a physical machine (RHEL 7.8). I am now suspending it is due to any misconfigure or limit in my Kuberneates setup.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 19, 2022, 6:02pm UTC](https://discuss.elastic.co/t/fillebeat-keeps-restarting-in-kuberneates/309702/5 "2022-09-19T18:02:11Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
