Throwing error starting filebeat on Ubuntu22

OpenSearch
,
1

Versions (relevant - OpenSearch/Dashboard/Server OS/Browser):
Filebeat version 7.11 and 7.12

Describe the issue:
After installing Filebeat 7.11 and 7.12 cannot start filebeat on Ubunut 22

Configuration:
Configured filebeat.yaml in /etc/filbeat.yaml

Relevant Logs or Screenshots:
filebeat -e
2023-12-08T08:39:53.156Z INFO instance/beat.go:660 Home path: [/usr/share/filebeat] Config path: [/etc/filebeat] Data path: [/var/lib/filebeat] Logs path: [/var/log/filebeat]
2023-12-08T08:39:53.169Z INFO [seccomp] seccomp/seccomp.go:124 Syscall filter successfully installed
2023-12-08T08:39:53.171Z INFO [beat] instance/beat.go:996 Beat info {“system_info”: {“beat”: {“path”: {“config”: “/etc/filebeat”, “data”: “/var/lib/filebeat”, “home”: “/usr/share/filebeat”, “logs”: “/var/log/filebeat”}, “type”: “filebeat”, “uuid”: “1f5ea032-feaf-4a10-83ab-4946eb96414d”}}}
2023-12-08T08:39:53.173Z INFO [beat] instance/beat.go:1005 Build info {“system_info”: {“build”: {“commit”: “08e20483a651ea5ad60115f68ff0e53e6360573a”, “libbeat”: “7.12.0”, “time”: “2021-03-18T05:18:49.000Z”, “version”: “7.12.0”}}}
2023-12-08T08:39:53.175Z INFO [beat] instance/beat.go:1008 Go runtime info {“system_info”: {“go”: {“os”:“linux”,“arch”:“amd64”,“max_procs”:1,“version”:“go1.15.8”}}}
2023-12-08T08:39:53.180Z INFO [beat] instance/beat.go:1012 Host info {“system_info”: {“host”: {“architecture”:“x86_64”,“boot_time”:“2023-12-08T07:38:20Z”,“containerized”:false,“name”:“”,“ip”:[“127.0.0.1/8”,“::1/128”,“192.168.82.4/21”,“fe80::250:56ff:feb2:5131/64”],“kernel_version”:“5.15.0-91-generic”,“mac”:[“00:50:56:b2:51:31”],“os”:{“type”:“linux”,“family”:“debian”,“platform”:“ubuntu”,“name”:“Ubuntu”,“version”:“22.04.3 LTS (Jammy Jellyfish)”,“major”:22,“minor”:4,“patch”:3,“codename”:“jammy”},“timezone”:“UTC”,“timezone_offset_sec”:0,“id”:“bd4e4f05ef8147e2bab44833d813572f”}}}
2023-12-08T08:39:53.184Z INFO [beat] instance/beat.go:1041 Process info {“system_info”: {“process”: {“capabilities”: {“inheritable”:null,“permitted”:[“chown”,“dac_override”,“dac_read_search”,“fowner”,“fsetid”,“kill”,“setgid”,“setuid”,“setpcap”,“linux_immutable”,“net_bind_service”,“net_broadcast”,“net_admin”,“net_raw”,“ipc_lock”,“ipc_owner”,“sys_module”,“sys_rawio”,“sys_chroot”,“sys_ptrace”,“sys_pacct”,“sys_admin”,“sys_boot”,“sys_nice”,“sys_resource”,“sys_time”,“sys_tty_config”,“mknod”,“lease”,“audit_write”,“audit_control”,“setfcap”,“mac_override”,“mac_admin”,“syslog”,“wake_alarm”,“block_suspend”,“audit_read”,“38”,“39”,“40”],“effective”:[“chown”,“dac_override”,“dac_read_search”,“fowner”,“fsetid”,“kill”,“setgid”,“setuid”,“setpcap”,“linux_immutable”,“net_bind_service”,“net_broadcast”,“net_admin”,“net_raw”,“ipc_lock”,“ipc_owner”,“sys_module”,“sys_rawio”,“sys_chroot”,“sys_ptrace”,“sys_pacct”,“sys_admin”,“sys_boot”,“sys_nice”,“sys_resource”,“sys_time”,“sys_tty_config”,“mknod”,“lease”,“audit_write”,“audit_control”,“setfcap”,“mac_override”,“mac_admin”,“syslog”,“wake_alarm”,“block_suspend”,“audit_read”,“38”,“39”,“40”],“bounding”:[“chown”,“dac_override”,“dac_read_search”,“fowner”,“fsetid”,“kill”,“setgid”,“setuid”,“setpcap”,“linux_immutable”,“net_bind_service”,“net_broadcast”,“net_admin”,“net_raw”,“ipc_lock”,“ipc_owner”,“sys_module”,“sys_rawio”,“sys_chroot”,“sys_ptrace”,“sys_pacct”,“sys_admin”,“sys_boot”,“sys_nice”,“sys_resource”,“sys_time”,“sys_tty_config”,“mknod”,“lease”,“audit_write”,“audit_control”,“setfcap”,“mac_override”,“mac_admin”,“syslog”,“wake_alarm”,“block_suspend”,“audit_read”,“38”,“39”,“40”],“ambient”:null}, “cwd”: “/etc/filebeat”, “exe”: “/usr/share/filebeat/bin/filebeat”, “name”: “filebeat”, “pid”: 3251, “ppid”: 3058, “seccomp”: {“mode”:“filter”,“no_new_privs”:true}, “start_time”: “2023-12-08T08:39:52.660Z”}}}
2023-12-08T08:39:53.186Z INFO instance/beat.go:304 Setup Beat: filebeat; Version: 7.12.0
2023-12-08T08:39:53.188Z INFO [index-management] idxmgmt/std.go:184 Set output.elasticsearch.index to ‘filebeat-7.12.0’ as ILM is enabled.
2023-12-08T08:39:53.190Z INFO eslegclient/connection.go:99 elasticsearch url: https://opensearch.test.com:443
2023-12-08T08:39:53.192Z INFO [publisher] pipeline/module.go:113 Beat name:
runtime/cgo: pthread_create failed: Operation not permitted
SIGABRT: abort
PC=0x7f7b221199fc m=4 sigcode=18446744073709551610

goroutine 0 [idle]:
runtime: unknown pc 0x7f7b221199fc
stack: frame={sp:0x7f7afa3eb810, fp:0x0} stack=[0x7f7af9bec1e8,0x7f7afa3ebde8)
00007f7afa3eb710: 0000000000000000 0000000000000000
00007f7afa3eb720: 0000000000000000 0000000000f3ed05 <runtime.funcspdelta+101>

2

Could you share the content of the filebeat.yaml file?

3

Hey sorry for late reply. Please find the content below. I have not modified anything other than URL and keys.

# This requires a Kibana endpoint configuration.
setup.kibana:

  # Kibana Host
  # Scheme and port can be left out and will be set to the default (http and 5601)
  # In case you specify and additional path, the scheme is required: http://localhost:5601/path
  # IPv6 addresses should always be defined as: https://[2001:db8::1]:5601
  #host: "localhost:5601"
   host: "https://events.sdfdfsf.com:443"
4

Hey @aravindasamy

Think you have the port incorrect. If your running TCP/TLS then it should look something like this.

host: "https://events.sdfdfsf.com:5601"

Unless you have a proxy in from of Opnesearch.

You may need to install logstash or Data Prepper to ingest logs coming from Filebeat.

5

@aravindasamy Is that the full configuration? What about the input and OpenSearch output?
Did that work for you before? If it was, what was the previous version of Filebeat?

6

Hi thanks for the comment. We are using a proxy setup so we don’t have to specify the port. Same version of filebeat is working on Ubuntu 20. Also I think this is known issue. Remember reading somewhere in github