Getting strange errors after enabling kubernetes metadata in filebeat

Andreas_Gkizas · June 6, 2023, 2:58pm

Ok I see you are deploying in ELK namespace and seems that your service account serviceaccount:elk:filebeat can not perform the needed actions

Please advise from the below:

github.com

elastic/beats/blob/main/deploy/kubernetes/filebeat-kubernetes.yaml

apiVersion: v1
kind: ServiceAccount
metadata:
  name: filebeat
  namespace: kube-system
  labels:
    k8s-app: filebeat
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: filebeat
  labels:
    k8s-app: filebeat
rules:
- apiGroups: [""] # "" indicates the core API group
  resources:
  - namespaces
  - pods
  - nodes

This file has been truncated. show original

The service account should be in namespace beats/filebeat-kubernetes.yaml at main · elastic/beats · GitHub .

Please reconfigure accordingly and I think you should be ok

Topic		Replies	Views
Add_kubernetes_metadata processor does not seem to work. Filebeat Data indexed to Elastic does not have any fields relevant to kubernetes Elasticsearch docker	3	802	February 18, 2023
Filebeat adding incorrect kubernetes metadata to events going to logstash Beats filebeat	5	1236	April 2, 2024
Error with filebeat on kubernetes 1.20 using add_kubernetes_metadata Beats filebeat	1	490	January 12, 2021
Filebeat unable obtain kubernetes metadata Beats docker , filebeat	2	979	September 23, 2020
Kubernetes metadata Beats	17	2490	July 17, 2017

Getting strange errors after enabling kubernetes metadata in filebeat

Related topics