# Journalbeats stops immediately after starting (Openshift)

**URL:** <https://discuss.elastic.co/t/journalbeats-stops-immediately-after-starting-openshift/171475>\
**Category:** Beats\
**Tags:** journalbeat\
**Created:** [March 8, 2019, 11:07am UTC](https://discuss.elastic.co/t/journalbeats-stops-immediately-after-starting-openshift/171475 "2019-03-08T11:07:54Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![llech](https://avatars.discourse-cdn.com/v4/letter/l/8dc957/32.png) [@llech](https://discuss.elastic.co/u/llech)\
**Post date:** [March 8, 2019, 11:07am UTC](https://discuss.elastic.co/t/journalbeats-stops-immediately-after-starting-openshift/171475/1 "2019-03-08T11:07:54Z")

</div>

Hello,

When I start Journalbeats 6.6.1 on Openshift 3.9, it stops immediately after starting with following log lines:

```
2019-03-08T10:55:02.215Z	WARN	[cfgwarn]	beater/journalbeat.go:49	EXPERIMENTAL: Journalbeat is experimental.
2019-03-08T10:55:02.219Z	INFO	instance/beat.go:403	journalbeat start running.
2019-03-08T10:55:02.219Z	INFO	[journalbeat]	beater/journalbeat.go:103	journalbeat is running! Hit CTRL-C to stop it.
2019-03-08T10:55:02.219Z	INFO	[journalbeat]	beater/journalbeat.go:128	journalbeat is stopping
2019-03-08T10:55:02.220Z	INFO	[monitoring]	log/log.go:117	Starting metrics logging every 30s
2019-03-08T10:55:02.223Z	INFO	[monitoring]	log/log.go:152	Total non-zero metrics	{"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":40,"time":{"ms":41}},"total":{"ticks":60,"time":{"ms":68},"value":0},"user":{"ticks":20,"time":{"ms":27}}},"handles":{"limit":{"hard":1048576,"soft":1048576},"open":5},"info":{"ephemeral_id":"bbdc988d-75c0-43f7-84c5-7c13ebc674c1","uptime":{"ms":31}},"memstats":{"gc_next":4194304,"memory_alloc":2300352,"memory_total":3812232,"rss":13090816}},"libbeat":{"config":{"module":{"running":0}},"output":{"type":"elasticsearch"},"pipeline":{"clients":0,"events":{"active":0}}},"system":{"cpu":{"cores":8},"load":{"1":0.91,"15":0.79,"5":0.94,"norm":{"1":0.1138,"15":0.0988,"5":0.1175}}}}}}
2019-03-08T10:55:02.223Z	INFO	[monitoring]	log/log.go:153	Uptime: 32.760187ms
2019-03-08T10:55:02.223Z	INFO	[monitoring]	log/log.go:130	Stopping metrics logging.
2019-03-08T10:55:02.223Z	INFO	instance/beat.go:413	journalbeat stopped.

```

I see no error and I have no idea what is wrong here. This is the configuration I'm using to start journalbeat:

```
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: journalbeat-config
  labels:
    k8s-app: journalbeat
data:
  journalbeat.yml: |-
    output.elasticsearch:
      hosts: ["https://elasticsearch-loadbalancer:80"]
      username: 
      password:
---      
apiVersion: extensions/v1beta1
kind: DaemonSet
metadata:
  name: journalbeat
  labels:
    k8s-app: journalbeat
spec:
  template:
    metadata:
      labels:
        k8s-app: journalbeat
    spec:
      serviceAccountName: filebeat
      terminationGracePeriodSeconds: 30
      containers:
        - name: journalbeat
          image: docker.elastic.co/beats/journalbeat:6.6.1
          env: []
          securityContext:
            runAsUser: 0
            privileged: true
          resources:
            limits:
              memory: 200Mi
            requests:
              cpu: 100m
              memory: 100Mi
          volumeMounts:
            - name: config
              mountPath: /usr/share/journalbeat/journalbeat.yml
              readOnly: true
              subPath: journalbeat.yml
            - name: varlibdockercontainers
              mountPath: /var/lib/docker/containers
              readOnly: true
      volumes:
        - name: config
          configMap:
            defaultMode: 0600
            name: journalbeat-config
        - name: varlibdockercontainers
          hostPath:
            path: /var/lib/docker/containers
```

---

<div class="post-metadata">

**Author:** ![llech](https://avatars.discourse-cdn.com/v4/letter/l/8dc957/32.png) [@llech](https://discuss.elastic.co/u/llech)\
**Post date:** [March 8, 2019, 12:40pm UTC](https://discuss.elastic.co/t/journalbeats-stops-immediately-after-starting-openshift/171475/2 "2019-03-08T12:40:30Z")

</div>

Sorry, I was confused by the log section that said that it default to journaldb

I've need to add:  
journalbeat.inputs:  
paths:

Now journalbeat starts but still does nothing.

My journal logs are under "/var/log/journal/_/_.journal" but when I've added such value to paths, I've got error: File not found.

---

<div class="post-metadata">

**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\
**Post date:** [March 11, 2019, 12:58pm UTC](https://discuss.elastic.co/t/journalbeats-stops-immediately-after-starting-openshift/171475/3 "2019-03-11T12:58:15Z")

</div>

You are running journalbeat in a container. This means you also need to mount `/var/log/journal` into your container, otherwise this directory does not exist for any process in the container.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 8, 2019, 2:58pm UTC](https://discuss.elastic.co/t/journalbeats-stops-immediately-after-starting-openshift/171475/4 "2019-04-08T14:58:16Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.