Journalbeats stops immediately after starting (Openshift)

Elastic Stack Beats
1

Hello,

When I start Journalbeats 6.6.1 on Openshift 3.9, it stops immediately after starting with following log lines:

2019-03-08T10:55:02.215Z	WARN	[cfgwarn]	beater/journalbeat.go:49	EXPERIMENTAL: Journalbeat is experimental.
2019-03-08T10:55:02.219Z	INFO	instance/beat.go:403	journalbeat start running.
2019-03-08T10:55:02.219Z	INFO	[journalbeat]	beater/journalbeat.go:103	journalbeat is running! Hit CTRL-C to stop it.
2019-03-08T10:55:02.219Z	INFO	[journalbeat]	beater/journalbeat.go:128	journalbeat is stopping
2019-03-08T10:55:02.220Z	INFO	[monitoring]	log/log.go:117	Starting metrics logging every 30s
2019-03-08T10:55:02.223Z	INFO	[monitoring]	log/log.go:152	Total non-zero metrics	{"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":40,"time":{"ms":41}},"total":{"ticks":60,"time":{"ms":68},"value":0},"user":{"ticks":20,"time":{"ms":27}}},"handles":{"limit":{"hard":1048576,"soft":1048576},"open":5},"info":{"ephemeral_id":"bbdc988d-75c0-43f7-84c5-7c13ebc674c1","uptime":{"ms":31}},"memstats":{"gc_next":4194304,"memory_alloc":2300352,"memory_total":3812232,"rss":13090816}},"libbeat":{"config":{"module":{"running":0}},"output":{"type":"elasticsearch"},"pipeline":{"clients":0,"events":{"active":0}}},"system":{"cpu":{"cores":8},"load":{"1":0.91,"15":0.79,"5":0.94,"norm":{"1":0.1138,"15":0.0988,"5":0.1175}}}}}}
2019-03-08T10:55:02.223Z	INFO	[monitoring]	log/log.go:153	Uptime: 32.760187ms
2019-03-08T10:55:02.223Z	INFO	[monitoring]	log/log.go:130	Stopping metrics logging.
2019-03-08T10:55:02.223Z	INFO	instance/beat.go:413	journalbeat stopped.

I see no error and I have no idea what is wrong here. This is the configuration I'm using to start journalbeat:

---
apiVersion: v1
kind: ConfigMap
metadata:
  name: journalbeat-config
  labels:
    k8s-app: journalbeat
data:
  journalbeat.yml: |-
    output.elasticsearch:
      hosts: [ "https://elasticsearch-loadbalancer:80" ]
      username: 
      password:
---      
apiVersion: extensions/v1beta1
kind: DaemonSet
metadata:
  name: journalbeat
  labels:
    k8s-app: journalbeat
spec:
  template:
    metadata:
      labels:
        k8s-app: journalbeat
    spec:
      serviceAccountName: filebeat
      terminationGracePeriodSeconds: 30
      containers:
        - name: journalbeat
          image: docker.elastic.co/beats/journalbeat:6.6.1
          env: []
          securityContext:
            runAsUser: 0
            privileged: true
          resources:
            limits:
              memory: 200Mi
            requests:
              cpu: 100m
              memory: 100Mi
          volumeMounts:
            - name: config
              mountPath: /usr/share/journalbeat/journalbeat.yml
              readOnly: true
              subPath: journalbeat.yml
            - name: varlibdockercontainers
              mountPath: /var/lib/docker/containers
              readOnly: true
      volumes:
        - name: config
          configMap:
            defaultMode: 0600
            name: journalbeat-config
        - name: varlibdockercontainers
          hostPath:
            path: /var/lib/docker/containers
2

Sorry, I was confused by the log section that said that it default to journaldb

I've need to add:
journalbeat.inputs:
paths:

Now journalbeat starts but still does nothing.

My journal logs are under "/var/log/journal//.journal" but when I've added such value to paths, I've got error: File not found.

1 Like
3

You are running journalbeat in a container. This means you also need to mount /var/log/journal into your container, otherwise this directory does not exist for any process in the container.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.