# Frequent restarts - kubernetes\_metadata

**URL:** https://discuss.elastic.co/t/frequent-restarts-kubernetes-metadata/143743
**Category:** Beats
**Created:** [August 9, 2018, 5:59pm UTC](https://discuss.elastic.co/t/frequent-restarts-kubernetes-metadata/143743 "2018-08-09T17:59:50Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![Raj\_Etta](https://avatars.discourse-cdn.com/v4/letter/r/a3d4f5/32.png) [@Raj\_Etta](https://discuss.elastic.co/u/Raj_Etta)
#### Post date: [August 9, 2018, 5:59pm UTC](https://discuss.elastic.co/t/frequent-restarts-kubernetes-metadata/143743/1 "2018-08-09T17:59:50Z")

</div>

Used the daemonset yaml at [https://raw.githubusercontent.com/elastic/beats/master/deploy/kubernetes/filebeat-kubernetes.yaml](https://raw.githubusercontent.com/elastic/beats/master/deploy/kubernetes/filebeat-kubernetes.yaml) with following added to filebeat-prospector(Version 6.2.4 and tried 6.3 also)

```auto
metadata:
  name: filebeat-prospectors
  namespace: kube-system
  labels:
    k8s-app: filebeat
    kubernetes.io/cluster-service: "true"
data:
  kubernetes.yml: |-
    - type: docker
      multiline.pattern: '^[[:digit:]]+'
      multiline.negate: true
      multiline.match: after
      exclude_lines: ['kafka']
      containers.ids:
      - "*"
      processors:
        - add_kubernetes_metadata:
            in_cluster: true

```

One of the error message from previously failed filebeat container. :

```auto
[signal SIGSEGV: segmentation violation code=0x1 addr=0x158 pc=0x13dd6fa]

goroutine 147 [running]:
github.com/elastic/beats/libbeat/processors/add_kubernetes_metadata.(*ContainerIndexer).GetIndexes(0xc420141d90, 0x0, 0xc420213230, 0xc420204120, 0xc420204060)
	/go/src/github.com/elastic/beats/libbeat/processors/add_kubernetes_metadata/indexers.go:161 +0x3a
github.com/elastic/beats/libbeat/processors/add_kubernetes_metadata.(*Indexers).GetIndexes(0xc420213230, 0x0, 0x0, 0x0, 0x0)
	/go/src/github.com/elastic/beats/libbeat/processors/add_kubernetes_metadata/indexers.go:76 +0x230
github.com/elastic/beats/libbeat/processors/add_kubernetes_metadata.(*kubernetesAnnotator).removePod(0xc4201541c0, 0x0)
	/go/src/github.com/elastic/beats/libbeat/processors/add_kubernetes_metadata/kubernetes.go:188 +0x3d
github.com/elastic/beats/libbeat/processors/add_kubernetes_metadata.(*kubernetesAnnotator).(github.com/elastic/beats/libbeat/processors/add_kubernetes_metadata.removePod)-fm(0x0)
	/go/src/github.com/elastic/beats/libbeat/processors/add_kubernetes_metadata/kubernetes.go:159 +0x34
github.com/elastic/beats/libbeat/processors/add_kubernetes_metadata.processEvent(0xc4203d6ed0, 0xc424673e90)
	/go/src/github.com/elastic/beats/libbeat/processors/add_kubernetes_metadata/kubernetes.go:175 +0x78
github.com/elastic/beats/libbeat/processors/add_kubernetes_metadata.(*kubernetesAnnotator).worker(0xc4201541c0)
	/go/src/github.com/elastic/beats/libbeat/processors/add_kubernetes_metadata/kubernetes.go:159 +0x26f
created by github.com/elastic/beats/libbeat/processors/add_kubernetes_metadata.newKubernetesAnnotator
	/go/src/github.com/elastic/beats/libbeat/processors/add_kubernetes_metadata/kubernetes.go:113 +0x9f7

```

Sometimes, we also saw the filebeat container consuming high CPU and the log file only has "\\" repeated over and over.

---

<div class="post-metadata">

### Author: ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)
#### Post date: [August 10, 2018, 6:27am UTC](https://discuss.elastic.co/t/frequent-restarts-kubernetes-metadata/143743/2 "2018-08-10T06:27:20Z")

</div>

Any chance you could open a Github issue with this repo? Can you reproduce this reliably? If yes, please provide as many details about how to reproduce as possible in the Github issue. (yes, you already provided quite a bit of data, thanks for that).

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 7, 2018, 8:27am UTC](https://discuss.elastic.co/t/frequent-restarts-kubernetes-metadata/143743/3 "2018-09-07T08:27:22Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
