Since upgrading from ELK 7.17.1 to ELK 8.6.2 (and even with ELK 8.7.1) we are experiencing OOMKilled on filebeat and metricbeat pods. We had no issues with ELK 7.17.1. Increasing the resources allocations does not resolve the issue and simply delays the crash. This appears to be a memory leak issue with beats.
State: Running
Started: Thu, 25 May 2023 15:18:43 +0000
Last State: Terminated
Reason: OOMKilled
Exit Code: 137
Started: Thu, 25 May 2023 02:53:22 +0000
Finished: Thu, 25 May 2023 15:18:41 +0000
Ready: True
This is an example of our filebeat pod memory in the past 24 hours
We have tried this config which was mentioned in other posts but it makes no differences. We also do not use cron jobs.
processors:
- add_kubernetes_metadata:
add_resource_metadata:
deployment: false
cronjob: false