Filebeat:数据路径已被另一个节拍锁定。请确保多个节拍不共享相同的数据路径

use*_*898 8 elasticsearch filebeat

查看其中一个 filebeat pod 中的日志,我可以看到以下内容:

2021-01-04T10:10:52.754Z        DEBUG   [add_cloud_metadata]    add_cloud_metadata/providers.go:129     add_cloud_metadata: fetchMetadata ran for 2.351101ms
2021-01-04T10:10:52.754Z        INFO    [add_cloud_metadata]    add_cloud_metadata/add_cloud_metadata.go:93     add_cloud_metadata: hosting provider type detected as openstack, metadata={"ava
ilability_zone":"us-east-1c","instance":{"id":"i-08f536567bd9945df","name":"ip-10-101-2-178.ec2.internal"},"machine":{"type":"m5.2xlarge"},"provider":"openstack"}
2021-01-04T10:10:52.755Z        DEBUG   [processors]    processors/processor.go:120     Generated new processors: add_cloud_metadata={"availability_zone":"us-east-1c","instance":{"id":"i-08f5
36567bd9945df","name":"ip-10-101-2-178.ec2.internal"},"machine":{"type":"m5.2xlarge"},"provider":"openstack"}, add_docker_metadata=[match_fields=[] match_pids=[process.pid, process.ppid]]    
2021-01-04T10:10:52.755Z        INFO    instance/beat.go:392    filebeat stopped.
2021-01-04T10:10:52.755Z        ERROR   instance/beat.go:956    Exiting: data path already locked by another beat. Please make sure that multiple beats are not sharing the same data path (pat
h.data).
Exiting: data path already locked by another beat. Please make sure that multiple beats are not sharing the same data path (path.data).
Run Code Online (Sandbox Code Playgroud)

如您所见,filebeat 因错误而停止:

data path already locked by another beat. Please make sure that multiple beats are not sharing the same data path (path.data).
Run Code Online (Sandbox Code Playgroud)

在 github/forum 中搜索问题后,我发现了这个:
https ://discuss.elastic.co/t/data-path-already-locked-by-another-beat/219852/4

这看起来像我的问题,我使用默认的 filebeat-kubernetes.yaml ,并且 ELK / Filebeats 文档中没有关于如何在 filebeat-kubernetes.yaml 中添加唯一路径的信息,
我在哪里添加它们以及如何制作它们独特的?谢谢

Ant*_*ton 9

我有同样的问题。这意味着您的数据路径(/var/lib/filebeats)被另一个 filebeat 实例锁定。因此,执行sudo systemctl stop filebeat(在我的例子中)以确保您没有运行 filebeat,然后运行 ​​filebeat 并sudo filebeat -e在控制台中打印日志

我也尝试过您分享的链接,但这对我没有帮助。这里另一个解决方案,可能会对您有所帮助:https ://discuss.elastic.co/t/data-path-already-locked-by-another-beat/219852/2