Journalbeats stops immediately after starting (Openshift)

Hello,

When I start Journalbeats 6.6.1 on Openshift 3.9, it stops immediately after starting with following log lines:

2019-03-08T10:55:02.215Z	WARN	[cfgwarn]	beater/journalbeat.go:49	EXPERIMENTAL: Journalbeat is experimental.
2019-03-08T10:55:02.219Z	INFO	instance/beat.go:403	journalbeat start running.
2019-03-08T10:55:02.219Z	INFO	[journalbeat]	beater/journalbeat.go:103	journalbeat is running! Hit CTRL-C to stop it.
2019-03-08T10:55:02.219Z	INFO	[journalbeat]	beater/journalbeat.go:128	journalbeat is stopping
2019-03-08T10:55:02.220Z	INFO	[monitoring]	log/log.go:117	Starting metrics logging every 30s
2019-03-08T10:55:02.223Z	INFO	[monitoring]	log/log.go:152	Total non-zero metrics	{"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":40,"time":{"ms":41}},"total":{"ticks":60,"time":{"ms":68},"value":0},"user":{"ticks":20,"time":{"ms":27}}},"handles":{"limit":{"hard":1048576,"soft":1048576},"open":5},"info":{"ephemeral_id":"bbdc988d-75c0-43f7-84c5-7c13ebc674c1","uptime":{"ms":31}},"memstats":{"gc_next":4194304,"memory_alloc":2300352,"memory_total":3812232,"rss":13090816}},"libbeat":{"config":{"module":{"running":0}},"output":{"type":"elasticsearch"},"pipeline":{"clients":0,"events":{"active":0}}},"system":{"cpu":{"cores":8},"load":{"1":0.91,"15":0.79,"5":0.94,"norm":{"1":0.1138,"15":0.0988,"5":0.1175}}}}}}
2019-03-08T10:55:02.223Z	INFO	[monitoring]	log/log.go:153	Uptime: 32.760187ms
2019-03-08T10:55:02.223Z	INFO	[monitoring]	log/log.go:130	Stopping metrics logging.
2019-03-08T10:55:02.223Z	INFO	instance/beat.go:413	journalbeat stopped.

I see no error and I have no idea what is wrong here. This is the configuration I'm using to start journalbeat:

---
apiVersion: v1
kind: ConfigMap
metadata:
  name: journalbeat-config
  labels:
    k8s-app: journalbeat
data:
  journalbeat.yml: |-
    output.elasticsearch:
      hosts: [ "https://elasticsearch-loadbalancer:80" ]
      username: 
      password:
---      
apiVersion: extensions/v1beta1
kind: DaemonSet
metadata:
  name: journalbeat
  labels:
    k8s-app: journalbeat
spec:
  template:
    metadata:
      labels:
        k8s-app: journalbeat
    spec:
      serviceAccountName: filebeat
      terminationGracePeriodSeconds: 30
      containers:
        - name: journalbeat
          image: docker.elastic.co/beats/journalbeat:6.6.1
          env: []
          securityContext:
            runAsUser: 0
            privileged: true
          resources:
            limits:
              memory: 200Mi
            requests:
              cpu: 100m
              memory: 100Mi
          volumeMounts:
            - name: config
              mountPath: /usr/share/journalbeat/journalbeat.yml
              readOnly: true
              subPath: journalbeat.yml
            - name: varlibdockercontainers
              mountPath: /var/lib/docker/containers
              readOnly: true
      volumes:
        - name: config
          configMap:
            defaultMode: 0600
            name: journalbeat-config
        - name: varlibdockercontainers
          hostPath:
            path: /var/lib/docker/containers

Sorry, I was confused by the log section that said that it default to journaldb

I've need to add:
journalbeat.inputs:
paths:

Now journalbeat starts but still does nothing.

My journal logs are under "/var/log/journal//.journal" but when I've added such value to paths, I've got error: File not found.

You are running journalbeat in a container. This means you also need to mount /var/log/journal into your container, otherwise this directory does not exist for any process in the container.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.