Filebeat service failed to start

[Sid J]

Hi Team,

i am new in wazuh and trying to learn the concept.

so i have created the Test lab on that running vm of Centos9 stream OS and installed wazuh 4.2 with the help of this great installation guide.

https://documentation.wazuh.com/current/installation-guide/open-distro/all-in-one-deployment/index.html#all-in-one-index

few days back i have added some windows agent and network devices.

and yesterday i have seen that alerts are not showing kibana portal.

and found that my filebeat service is not running.

 systemctl status filebeat.service
× filebeat.service - Filebeat sends log files to Logstash or directly to Elasticsearch.
     Loaded: loaded (/usr/lib/systemd/system/filebeat.service; enabled; vendor preset: disabled)
     Active: failed (Result: exit-code) since Tue 2022-03-08 15:52:25 IST; 7min ago
       Docs: https://www.elastic.co/products/beats/filebeat
    Process: 15146 ExecStart=/usr/share/filebeat/bin/filebeat --environment systemd $BEAT_LOG_OPTS $BEAT_CONFIG_OPTS $BEAT_PATH_OPTS (code=exited, status=2)
   Main PID: 15146 (code=exited, status=2)
        CPU: 371ms

Mar 08 15:52:25 WC filebeat[15146]: rflags 0x246
Mar 08 15:52:25 WC filebeat[15146]: cs     0x33
Mar 08 15:52:25 WC filebeat[15146]: fs     0x0
Mar 08 15:52:25 WC filebeat[15146]: gs     0x0
Mar 08 15:52:25 WC systemd[1]: filebeat.service: Failed with result 'exit-code'.
Mar 08 15:52:25 WC systemd[1]: filebeat.service: Scheduled restart job, restart counter is at 5.
Mar 08 15:52:25 WC systemd[1]: Stopped Filebeat sends log files to Logstash or directly to Elasticsearch..
Mar 08 15:52:25 WC systemd[1]: filebeat.service: Start request repeated too quickly.
Mar 08 15:52:25 WC systemd[1]: filebeat.service: Failed with result 'exit-code'.
Mar 08 15:52:25 WC systemd[1]: Failed to start Filebeat sends log files to Logstash or directly to Elasticsearch..

 filebeat test output
elasticsearch: https://127.0.0.1:9200...
  parse url... OK
  connection...
    parse host... OK
    dns lookup... OK
    addresses: 127.0.0.1
    dial up... OK
  TLS...
    security: server's certificate chain verification is enabled
    handshake... OK
    TLS version: TLSv1.3
    dial up... OK
  talk to server... OK
  version: 7.10.2

please guide how to solve this.

Thanks

[Jonathan Martín Valera]

Hi,

Glad you try and like Wazuh.

According to the filebeat test output command result it seems that the configuration and connection is correct, but the Filebeat service is failed for some reason.

• If you start the service, does it go down immediately, or does it go down after a while?

• You mentioned that at first, it worked, but then it stopped working. Was there any change in the environment or anything that might give us a clue as to what might be going on?

The systemctl status filebeat log you have shown does not show much information. Try the following command to see the Filebeat logs.

journalctl -xe -u filebeat

Share the whole log to see if we can detect the reason.

Regards.

​

[Sid J]

Hi,

Thank you for your prompt response.

1. Yes, it starts and immediately stops.

2. I have just added a network device and some windows agents.

I ran this command  journalctl -xe -u filebeat and got the output below.

journalctl -xe -u filebeat
Mar 08 17:04:28 WC filebeat[15490]:         /usr/local/go/src/runtime/sigqueue.go:147 +0x9c
Mar 08 17:04:28 WC filebeat[15490]: os/signal.loop()
Mar 08 17:04:28 WC filebeat[15490]:         /usr/local/go/src/os/signal/signal_unix.go:23 +0x22
Mar 08 17:04:28 WC filebeat[15490]: created by os/signal.Notify.func1
Mar 08 17:04:28 WC filebeat[15490]:         /usr/local/go/src/os/signal/signal.go:127 +0x44
Mar 08 17:04:28 WC filebeat[15490]: goroutine 97 [chan receive]:
Mar 08 17:04:28 WC filebeat[15490]: github.com/elastic/beats/v7/libbeat/service.HandleSignals.func1(0xc000127080, 0xc00084b030, 0xc00084b020, 0xc0001242b0, 0xc00051ebe>
Mar 08 17:04:28 WC filebeat[15490]:         /go/src/github.com/elastic/beats/libbeat/service/service.go:50 +0x52
Mar 08 17:04:28 WC filebeat[15490]: created by github.com/elastic/beats/v7/libbeat/service.HandleSignals
Mar 08 17:04:28 WC filebeat[15490]:         /go/src/github.com/elastic/beats/libbeat/service/service.go:49 +0x172
Mar 08 17:04:28 WC filebeat[15490]: rax    0x0
Mar 08 17:04:28 WC filebeat[15490]: rbx    0x7fc6c3fff640
Mar 08 17:04:28 WC filebeat[15490]: rcx    0x7fc6ef5ab43c
Mar 08 17:04:28 WC filebeat[15490]: rdx    0x6
Mar 08 17:04:28 WC filebeat[15490]: rdi    0x3c82
Mar 08 17:04:28 WC filebeat[15490]: rsi    0x3c85
Mar 08 17:04:28 WC filebeat[15490]: rbp    0x3c85
Mar 08 17:04:28 WC filebeat[15490]: rsp    0x7fc6c3ffe7b0
Mar 08 17:04:28 WC filebeat[15490]: r8     0x7fc6c3ffe880
Mar 08 17:04:28 WC filebeat[15490]: r9     0x7fc6ef6bb4e0
Mar 08 17:04:28 WC filebeat[15490]: r10    0x8
Mar 08 17:04:28 WC filebeat[15490]: r11    0x246
Mar 08 17:04:28 WC filebeat[15490]: r12    0x6
Mar 08 17:04:28 WC filebeat[15490]: r13    0x0
Mar 08 17:04:28 WC filebeat[15490]: r14    0x2cf0118
Mar 08 17:04:28 WC filebeat[15490]: r15    0x0
Mar 08 17:04:28 WC filebeat[15490]: rip    0x7fc6ef5ab43c
Mar 08 17:04:28 WC filebeat[15490]: rflags 0x246
Mar 08 17:04:28 WC filebeat[15490]: cs     0x33
Mar 08 17:04:28 WC filebeat[15490]: fs     0x0
Mar 08 17:04:28 WC filebeat[15490]: gs     0x0
Mar 08 17:04:28 WC systemd[1]: filebeat.service: Main process exited, code=exited, status=2/INVALIDARGUMENT
░░ Subject: Unit process exited
░░ Defined-By: systemd
░░ Support: https://access.redhat.com/support
░░
░░ An ExecStart= process belonging to unit filebeat.service has exited.
░░
░░ The process' exit code is 'exited' and its exit status is 2.
Mar 08 17:04:28 WC systemd[1]: filebeat.service: Failed with result 'exit-code'.
░░ Subject: Unit failed
░░ Defined-By: systemd
░░ Support: https://access.redhat.com/support
░░
░░ The unit filebeat.service has entered the 'failed' state with result 'exit-code'.
Mar 08 17:04:28 WC systemd[1]: filebeat.service: Scheduled restart job, restart counter is at 1.
░░ Subject: Automatic restarting of a unit has been scheduled
░░ Defined-By: systemd
░░ Support: https://access.redhat.com/support
░░
░░ Automatic restarting of the unit filebeat.service has been scheduled, as the result for
░░ the configured Restart= setting for the unit.
Mar 08 17:04:28 WC systemd[1]: Stopped Filebeat sends log files to Logstash or directly to Elasticsearch..
░░ Subject: A stop job for unit filebeat.service has finished
░░ Defined-By: systemd
░░ Support: https://access.redhat.com/support
░░
░░ A stop job for unit filebeat.service has finished.
░░
░░ The job identifier is 11951 and the job result is done.
Mar 08 17:04:28 WC systemd[1]: Started Filebeat sends log files to Logstash or directly to Elasticsearch..
░░ Subject: A start job for unit filebeat.service has finished successfully
░░ Defined-By: systemd
░░ Support: https://access.redhat.com/support
░░
░░ A start job for unit filebeat.service has finished successfully.
░░
░░ The job identifier is 11951.
Mar 08 17:04:28 WC filebeat[15500]: 2022-03-08T17:04:28.597+0530        INFO        instance/beat.go:645        Home path: [/usr/share/filebeat] Config path: [/etc/fil>
Mar 08 17:04:28 WC filebeat[15500]: 2022-03-08T17:04:28.598+0530        INFO        instance/beat.go:653        Beat ID: 3d0668f2-7e97-49bf-80b0-dedb88a541e4
Mar 08 17:04:28 WC filebeat[15500]: 2022-03-08T17:04:28.598+0530        INFO        [seccomp]        seccomp/seccomp.go:124        Syscall filter successfully installed
Mar 08 17:04:28 WC filebeat[15500]: 2022-03-08T17:04:28.598+0530        INFO        [beat]        instance/beat.go:981        Beat info        {"system_info": {"beat":>
Mar 08 17:04:28 WC filebeat[15500]: 2022-03-08T17:04:28.598+0530        INFO        [beat]        instance/beat.go:990        Build info        {"system_info": {"build>
Mar 08 17:04:28 WC filebeat[15500]: 2022-03-08T17:04:28.598+0530        INFO        [beat]        instance/beat.go:993        Go runtime info        {"system_info": {">
Mar 08 17:04:28 WC filebeat[15500]: 2022-03-08T17:04:28.598+0530        INFO        [beat]        instance/beat.go:997        Host info        {"system_info": {"host":>
Mar 08 17:04:28 WC filebeat[15500]: 2022-03-08T17:04:28.599+0530        INFO        [beat]        instance/beat.go:1026        Process info        {"system_info": {"pr>
Mar 08 17:04:28 WC filebeat[15500]: 2022-03-08T17:04:28.599+0530        INFO        instance/beat.go:299        Setup Beat: filebeat; Version: 7.10.2
Mar 08 17:04:28 WC filebeat[15500]: 2022-03-08T17:04:28.599+0530        INFO        eslegclient/connection.go:99        elasticsearch url: https://127.0.0.1:9200
Mar 08 17:04:28 WC filebeat[15500]: 2022-03-08T17:04:28.599+0530        INFO        [publisher]        pipeline/module.go:113        Beat name: WC
Mar 08 17:04:28 WC filebeat[15500]: 2022-03-08T17:04:28.601+0530        INFO        beater/filebeat.go:117        Enabled modules/filesets:  (), wazuh (alerts)
Mar 08 17:04:28 WC filebeat[15500]: 2022-03-08T17:04:28.601+0530        INFO        instance/beat.go:455        filebeat start running.
Mar 08 17:04:28 WC filebeat[15500]: 2022-03-08T17:04:28.601+0530        INFO        [monitoring]        log/log.go:118        Starting metrics logging every 30s
Mar 08 17:04:28 WC filebeat[15500]: 2022-03-08T17:04:28.602+0530        INFO        memlog/store.go:119        Loading data file of '/var/lib/filebeat/registry/filebea>
Mar 08 17:04:28 WC filebeat[15500]: 2022-03-08T17:04:28.825+0530        INFO        memlog/store.go:124        Finished loading transaction log file for '/var/lib/file>
Mar 08 17:04:28 WC filebeat[15500]: 2022-03-08T17:04:28.826+0530        INFO        [registrar]        registrar/registrar.go:109        States Loaded from registrar: 1
Mar 08 17:04:28 WC filebeat[15500]: 2022-03-08T17:04:28.826+0530        INFO        [crawler]        beater/crawler.go:71        Loading Inputs: 1
Mar 08 17:04:28 WC filebeat[15500]: 2022-03-08T17:04:28.827+0530        INFO        log/input.go:157        Configured paths: [/var/ossec/logs/alerts/alerts.json]
Mar 08 17:04:28 WC filebeat[15500]: 2022-03-08T17:04:28.828+0530        INFO        [crawler]        beater/crawler.go:141        Starting input (ID: 91323585928928574>
Mar 08 17:04:28 WC filebeat[15500]: 2022-03-08T17:04:28.828+0530        INFO        [crawler]        beater/crawler.go:108        Loading and starting Inputs completed>
Mar 08 17:04:28 WC filebeat[15500]: 2022-03-08T17:04:28.828+0530        INFO        log/harvester.go:302        Harvester started for file: /var/ossec/logs/alerts/aler>
Mar 08 17:04:28 WC filebeat[15500]: 2022-03-08T17:04:28.860+0530        INFO        [publisher_pipeline_output]        pipeline/output.go:143        Connecting to back>
Mar 08 17:04:28 WC filebeat[15500]: 2022-03-08T17:04:28.860+0530        INFO        [publisher]        pipeline/retry.go:219        retryer: send unwait signal to cons>
Mar 08 17:04:28 WC filebeat[15500]: 2022-03-08T17:04:28.860+0530        INFO        [publisher]        pipeline/retry.go:223          done
Mar 08 17:04:29 WC filebeat[15500]: 2022-03-08T17:04:29.153+0530        INFO        [esclientleg]        eslegclient/connection.go:314        Attempting to connect to >
Mar 08 17:04:29 WC filebeat[15500]: 2022-03-08T17:04:29.153+0530        INFO        [esclientleg]        eslegclient/connection.go:314        Attempting to connect to >
Mar 08 17:04:29 WC filebeat[15500]: 2022-03-08T17:04:29.154+0530        INFO        template/load.go:97        Template wazuh already exists and will not be overwritte>
Mar 08 17:04:29 WC filebeat[15500]: 2022-03-08T17:04:29.154+0530        INFO        [index-management]        idxmgmt/std.go:298        Loaded index template.
Mar 08 17:04:29 WC filebeat[15500]: 2022-03-08T17:04:29.155+0530        INFO        [publisher_pipeline_output]        pipeline/output.go:151        Connection to back>
Mar 08 17:04:29 WC filebeat[15500]: runtime/cgo: pthread_create failed: Operation not permitted
Mar 08 17:04:29 WC filebeat[15500]: SIGABRT: abort
Mar 08 17:04:29 WC filebeat[15500]: PC=0x7ffb2956f43c m=2 sigcode=18446744073709551610
Mar 08 17:04:29 WC filebeat[15500]: goroutine 0 [idle]:
Mar 08 17:04:29 WC filebeat[15500]: runtime: unknown pc 0x7ffb2956f43c
Mar 08 17:04:29 WC filebeat[15500]: stack: frame={sp:0x7ffb02833760, fp:0x0} stack=[0x7ffb020341e8,0x7ffb02833de8)
Mar 08 17:04:29 WC filebeat[15500]: 00007ffb02833660:  0000000000000000  0000000000000000
Mar 08 17:04:29 WC filebeat[15500]: 00007ffb02833670:  0000000000000000  0000000000000000
Mar 08 17:04:29 WC filebeat[15500]: 00007ffb02833680:  0000000000000000  0000000000000000
Mar 08 17:04:29 WC filebeat[15500]: 00007ffb02833690:  0000000000000000  0000000000000000
Mar 08 17:04:29 WC filebeat[15500]: 00007ffb028336a0:  0000000000000000  0000000000000000
Mar 08 17:04:29 WC filebeat[15500]: 00007ffb028336b0:  0000000000000000  0000000000000000
Mar 08 17:04:29 WC filebeat[15500]: 00007ffb028336c0:  0000000000000000  0000000000000000
Mar 08 17:04:29 WC filebeat[15500]: 00007ffb028336d0:  0000000000000000  0000000000000000
Mar 08 17:04:29 WC filebeat[15500]: 00007ffb028336e0:  0000000000000000  0000000000000000
Mar 08 17:04:29 WC filebeat[15500]: 00007ffb028336f0:  0000000000000000  0000000000000000
Mar 08 17:04:29 WC filebeat[15500]: 00007ffb02833700:  0000000000000000  0000000000000000
Mar 08 17:04:29 WC filebeat[15500]: 00007ffb02833710:  0000000000000000  0000000000000000
Mar 08 17:04:29 WC filebeat[15500]: 00007ffb02833720:  0000000000000000  0000000000000000
Mar 08 17:04:29 WC filebeat[15500]: 00007ffb02833730:  0000000000000000  0000000000000000
Mar 08 17:04:29 WC filebeat[15500]: 00007ffb02833740:  0000000000000000  00007ffb2957ca49
Mar 08 17:04:29 WC filebeat[15500]: 00007ffb02833750:  0000000000000000  00007ffb2956f42e
Mar 08 17:04:29 WC filebeat[15500]: 00007ffb02833760: <0000000000000130  0000000000000000
Mar 08 17:04:29 WC filebeat[15500]: 00007ffb02833770:  0000000000000120  0000000000000000
Mar 08 17:04:29 WC filebeat[15500]: 00007ffb02833780:  0000000000000013  0000000000000000
Mar 08 17:04:29 WC filebeat[15500]: 00007ffb02833790:  0000000000000000  0000000000000004
Mar 08 17:04:29 WC filebeat[15500]: 00007ffb028337a0:  0000003400000013  00007ffb2961d6d1
Mar 08 17:04:29 WC filebeat[15500]: 00007ffb028337b0:  00007ffaf9ffb640  00007ffb02833a70
Mar 08 17:04:29 WC filebeat[15500]: 00007ffb028337c0:  00007ffb028338ee  00007ffb028338ef
Mar 08 17:04:29 WC filebeat[15500]: 00007ffb028337d0:  00007ffaf9ffb640  00007ffb2956d2f5
Mar 08 17:04:29 WC filebeat[15500]: 00007ffb028337e0:  00007ffafc000020  d13c452de5345000
Mar 08 17:04:29 WC filebeat[15500]: 00007ffb028337f0:  00007ffb02834640  0000000000000006
Mar 08 17:04:29 WC filebeat[15500]: 00007ffb02833800:  0000000004ab12e0  0000000000000000
Mar 08 17:04:29 WC filebeat[15500]: 00007ffb02833810:  0000000002cf0118  00007ffb29522d06
Mar 08 17:04:29 WC filebeat[15500]: 00007ffb02833820:  00007ffb296c5990  00007ffb294f57d3
Mar 08 17:04:29 WC filebeat[15500]: 00007ffb02833830:  0000000000000020  0000000000000000
Mar 08 17:04:29 WC filebeat[15500]: 00007ffb02833840:  0000000000000000  00007ffb2960d174
Mar 08 17:04:29 WC filebeat[15500]: 00007ffb02833850:  00007ffaf97fb000  000000000000000d
Mar 08 17:04:29 WC filebeat[15500]: runtime: unknown pc 0x7ffb2956f43c
Mar 08 17:04:29 WC filebeat[15500]: stack: frame={sp:0x7ffb02833760, fp:0x0} stack=[0x7ffb020341e8,0x7ffb02833de8)
Mar 08 17:04:29 WC filebeat[15500]: 00007ffb02833660:  0000000000000000  0000000000000000
Mar 08 17:04:29 WC filebeat[15500]: 00007ffb02833670:  0000000000000000  0000000000000000
Mar 08 17:04:29 WC filebeat[15500]: 00007ffb02833680:  0000000000000000  0000000000000000
Mar 08 17:04:29 WC filebeat[15500]: 00007ffb02833690:  0000000000000000  0000000000000000
Mar 08 17:04:29 WC filebeat[15500]: 00007ffb028336a0:  0000000000000000  0000000000000000
Mar 08 17:04:29 WC filebeat[15500]: 00007ffb028336b0:  0000000000000000  0000000000000000
Mar 08 17:04:29 WC filebeat[15500]: 00007ffb028336c0:  0000000000000000  0000000000000000
Mar 08 17:04:29 WC filebeat[15500]: 00007ffb028336d0:  0000000000000000  0000000000000000
Mar 08 17:04:29 WC filebeat[15500]: 00007ffb028336e0:  0000000000000000  0000000000000000
Mar 08 17:04:29 WC filebeat[15500]: 00007ffb028336f0:  0000000000000000  0000000000000000
Mar 08 17:04:29 WC filebeat[15500]: 00007ffb02833700:  0000000000000000  0000000000000000
Mar 08 17:04:29 WC filebeat[15500]: 00007ffb02833710:  0000000000000000  0000000000000000
Mar 08 17:04:29 WC filebeat[15500]: 00007ffb02833720:  0000000000000000  0000000000000000
Mar 08 17:04:29 WC filebeat[15500]: 00007ffb02833730:  0000000000000000  0000000000000000
Mar 08 17:04:29 WC filebeat[15500]: 00007ffb02833740:  0000000000000000  00007ffb2957ca49
Mar 08 17:04:29 WC filebeat[15500]: 00007ffb02833750:  0000000000000000  00007ffb2956f42e
Mar 08 17:04:29 WC filebeat[15500]: 00007ffb02833760: <0000000000000130  0000000000000000
Mar 08 17:04:29 WC filebeat[15500]: 00007ffb02833770:  0000000000000120  0000000000000000
Mar 08 17:04:29 WC filebeat[15500]: 00007ffb02833780:  0000000000000013  0000000000000000
Mar 08 17:04:29 WC filebeat[15500]: 00007ffb02833790:  0000000000000000  0000000000000004
Mar 08 17:04:29 WC filebeat[15500]: 00007ffb028337a0:  0000003400000013  00007ffb2961d6d1
Mar 08 17:04:29 WC filebeat[15500]: 00007ffb028337b0:  00007ffaf9ffb640  00007ffb02833a70
Mar 08 17:04:29 WC filebeat[15500]: 00007ffb028337c0:  00007ffb028338ee  00007ffb028338ef
Mar 08 17:04:29 WC filebeat[15500]: 00007ffb028337d0:  00007ffaf9ffb640  00007ffb2956d2f5
Mar 08 17:04:29 WC filebeat[15500]: 00007ffb028337e0:  00007ffafc000020  d13c452de5345000
Mar 08 17:04:29 WC filebeat[15500]: 00007ffb028337f0:  00007ffb02834640  0000000000000006
Mar 08 17:04:29 WC filebeat[15500]: 00007ffb02833800:  0000000004ab12e0  0000000000000000
Mar 08 17:04:29 WC filebeat[15500]: 00007ffb02833810:  0000000002cf0118  00007ffb29522d06
Mar 08 17:04:29 WC filebeat[15500]: 00007ffb02833820:  00007ffb296c5990  00007ffb294f57d3
Mar 08 17:04:29 WC filebeat[15500]: 00007ffb02833830:  0000000000000020  0000000000000000
Mar 08 17:04:29 WC filebeat[15500]: 00007ffb02833840:  0000000000000000  00007ffb2960d174
Mar 08 17:04:29 WC filebeat[15500]: 00007ffb02833850:  00007ffaf97fb000  000000000000000d
Mar 08 17:04:29 WC filebeat[15500]: goroutine 1 [chan receive]:
Mar 08 17:04:29 WC filebeat[15500]: github.com/elastic/beats/v7/filebeat/beater.(*signalWait).Wait(...)
Mar 08 17:04:29 WC filebeat[15500]:         /go/src/github.com/elastic/beats/filebeat/beater/signalwait.go:45
Mar 08 17:04:29 WC filebeat[15500]: github.com/elastic/beats/v7/filebeat/beater.(*Filebeat).Run(0xc00032e480, 0xc0001c4580, 0x0, 0x0)
Mar 08 17:04:29 WC filebeat[15500]:         /go/src/github.com/elastic/beats/filebeat/beater/filebeat.go:482 +0x16c7
Mar 08 17:04:29 WC filebeat[15500]: github.com/elastic/beats/v7/libbeat/cmd/instance.(*Beat).launch(0xc0001c4580, 0x29fa2ec, 0x8, 0x29fa2ec, 0x8, 0x0, 0x0, 0x1, 0x0, 0>
Mar 08 17:04:29 WC filebeat[15500]:         /go/src/github.com/elastic/beats/libbeat/cmd/instance/beat.go:461 +0x7d8
Mar 08 17:04:29 WC filebeat[15500]: github.com/elastic/beats/v7/libbeat/cmd/instance.Run.func1(0x29fa2ec, 0x8, 0x29fa2ec, 0x8, 0x0, 0x0, 0xc00056dc30, 0xc00024a100, 0x>
Mar 08 17:04:29 WC filebeat[15500]:         /go/src/github.com/elastic/beats/libbeat/cmd/instance/beat.go:189 +0x55a
Mar 08 17:04:29 WC filebeat[15500]: github.com/elastic/beats/v7/libbeat/cmd/instance.Run(0x29fa2ec, 0x8, 0x29fa2ec, 0x8, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, ...)
Mar 08 17:04:29 WC filebeat[15500]:         /go/src/github.com/elastic/beats/libbeat/cmd/instance/beat.go:190 +0x148
Mar 08 17:04:29 WC filebeat[15500]: github.com/elastic/beats/v7/libbeat/cmd.genRunCmd.func1(0xc0001c42c0, 0xc000148180, 0x0, 0xc)
Mar 08 17:04:29 WC filebeat[15500]:         /go/src/github.com/elastic/beats/libbeat/cmd/run.go:36 +0x9d
Mar 08 17:04:29 WC filebeat[15500]: github.com/spf13/cobra.(*Command).execute(0xc0001c42c0, 0xc0001960e0, 0xc, 0xc, 0xc0001c42c0, 0xc0001960e0)
Mar 08 17:04:29 WC filebeat[15500]:         /go/pkg/mod/github.com/spf13/co...@v0.0.5/command.go:830 +0x29d
Mar 08 17:04:29 WC filebeat[15500]: github.com/spf13/cobra.(*Command).ExecuteC(0xc0001c42c0, 0xc0001c42c0, 0xffffffff, 0xc000180058)
Mar 08 17:04:29 WC filebeat[15500]:         /go/pkg/mod/github.com/spf13/co...@v0.0.5/command.go:914 +0x2fb
Mar 08 17:04:29 WC filebeat[15500]: github.com/spf13/cobra.(*Command).Execute(...)
Mar 08 17:04:29 WC filebeat[15500]:         /go/pkg/mod/github.com/spf13/co...@v0.0.5/command.go:864
Mar 08 17:04:29 WC filebeat[15500]: main.main()
Mar 08 17:04:29 WC filebeat[15500]:         /go/src/github.com/elastic/beats/filebeat/main.go:36 +0x3d
Mar 08 17:04:29 WC filebeat[15500]: goroutine 75 [chan receive]:
Mar 08 17:04:29 WC filebeat[15500]: github.com/elastic/beats/v7/filebeat/channel.SubOutlet.func1(0xc0008a2660, 0x2d6c5a0, 0xc0008b0d20)
Mar 08 17:04:29 WC filebeat[15500]:         /go/src/github.com/elastic/beats/filebeat/channel/util.go:44 +0x150
Mar 08 17:04:29 WC filebeat[15500]: created by github.com/elastic/beats/v7/filebeat/channel.SubOutlet
Mar 08 17:04:29 WC filebeat[15500]:         /go/src/github.com/elastic/beats/filebeat/channel/util.go:43 +0xf8
Mar 08 17:04:29 WC filebeat[15500]: goroutine 4 [chan receive]:
Mar 08 17:04:29 WC filebeat[15500]: k8s.io/klog.(*loggingT).flushDaemon(0x4241ce0)
Mar 08 17:04:29 WC filebeat[15500]:         /go/pkg/mod/k8s.io/kl...@v1.0.0/klog.go:1010 +0x8b
Mar 08 17:04:29 WC filebeat[15500]: created by k8s.io/klog.init.0
Mar 08 17:04:29 WC filebeat[15500]:         /go/pkg/mod/k8s.io/kl...@v1.0.0/klog.go:411 +0xd6
Mar 08 17:04:29 WC filebeat[15500]: goroutine 67 [select]:
Mar 08 17:04:29 WC filebeat[15500]: github.com/elastic/beats/v7/libbeat/publisher/queue/memqueue.(*bufferingEventLoop).run(0xc00064c000)
Mar 08 17:04:29 WC filebeat[15500]:         /go/src/github.com/elastic/beats/libbeat/publisher/queue/memqueue/eventloop.go:316 +0x1cf
Mar 08 17:04:29 WC filebeat[15500]: github.com/elastic/beats/v7/libbeat/publisher/queue/memqueue.NewQueue.func1(0xc0001f73b0, 0x2d3ed60, 0xc00064c000)
Mar 08 17:04:29 WC filebeat[15500]:         /go/src/github.com/elastic/beats/libbeat/publisher/queue/memqueue/broker.go:171 +0x5f
Mar 08 17:04:29 WC filebeat[15500]: created by github.com/elastic/beats/v7/libbeat/publisher/queue/memqueue.NewQueue
Mar 08 17:04:29 WC filebeat[15500]:         /go/src/github.com/elastic/beats/libbeat/publisher/queue/memqueue/broker.go:169 +0x373
Mar 08 17:04:29 WC filebeat[15500]: goroutine 68 [select]:
Mar 08 17:04:29 WC filebeat[15500]: github.com/elastic/beats/v7/libbeat/publisher/queue/memqueue.(*ackLoop).run(0xc000317220)
Mar 08 17:04:29 WC filebeat[15500]:         /go/src/github.com/elastic/beats/libbeat/publisher/queue/memqueue/ackloop.go:60 +0x107
Mar 08 17:04:29 WC filebeat[15500]: github.com/elastic/beats/v7/libbeat/publisher/queue/memqueue.NewQueue.func2(0xc0001f73b0, 0xc000317220)
Mar 08 17:04:29 WC filebeat[15500]:         /go/src/github.com/elastic/beats/libbeat/publisher/queue/memqueue/broker.go:175 +0x59
Mar 08 17:04:29 WC filebeat[15500]: created by github.com/elastic/beats/v7/libbeat/publisher/queue/memqueue.NewQueue
Mar 08 17:04:29 WC filebeat[15500]:         /go/src/github.com/elastic/beats/libbeat/publisher/queue/memqueue/broker.go:173 +0x3a2
Mar 08 17:04:29 WC filebeat[15500]: goroutine 69 [select]:
Mar 08 17:04:29 WC filebeat[15500]: github.com/elastic/beats/v7/libbeat/publisher/pipeline.(*eventConsumer).loop(0xc0001a2180, 0x2d3eda0, 0xc000127460)
Mar 08 17:04:29 WC filebeat[15500]:         /go/src/github.com/elastic/beats/libbeat/publisher/pipeline/consumer.go:207 +0x3b8
Mar 08 17:04:29 WC filebeat[15500]: github.com/elastic/beats/v7/libbeat/publisher/pipeline.newEventConsumer.func1(0xc0001a2180, 0x2d3eda0, 0xc000127440)
Mar 08 17:04:29 WC filebeat[15500]:         /go/src/github.com/elastic/beats/libbeat/publisher/pipeline/consumer.go:86 +0x6c
Mar 08 17:04:29 WC filebeat[15500]: created by github.com/elastic/beats/v7/libbeat/publisher/pipeline.newEventConsumer
Mar 08 17:04:29 WC filebeat[15500]:         /go/src/github.com/elastic/beats/libbeat/publisher/pipeline/consumer.go:84 +0x149
Mar 08 17:04:29 WC filebeat[15500]: goroutine 70 [select]:
Mar 08 17:04:29 WC filebeat[15500]: github.com/elastic/beats/v7/libbeat/publisher/pipeline.(*retryer).loop(0xc0001a2300)
Mar 08 17:04:29 WC filebeat[15500]:         /go/src/github.com/elastic/beats/libbeat/publisher/pipeline/retry.go:135 +0x250
Mar 08 17:04:29 WC filebeat[15500]: created by github.com/elastic/beats/v7/libbeat/publisher/pipeline.newRetryer
Mar 08 17:04:29 WC filebeat[15500]:         /go/src/github.com/elastic/beats/libbeat/publisher/pipeline/retry.go:94 +0x158
Mar 08 17:04:29 WC filebeat[15500]: goroutine 71 [runnable]:
Mar 08 17:04:29 WC filebeat[15500]: github.com/elastic/go-structform/json.(*Visitor).writeByte(0xc0000fa000, 0x2a01722, 0x4, 0x0)
Mar 08 17:04:29 WC filebeat[15500]:         /go/pkg/mod/github.com/elastic/go-str...@v0.0.7/json/visitor.go:95 +0x79
Mar 08 17:04:29 WC filebeat[15500]: github.com/elastic/go-structform/json.(*Visitor).OnString(0xc0000fa000, 0x2a017f0, 0x4, 0x270ee40, 0xc0005e46c8)
Mar 08 17:04:29 WC filebeat[15500]:         /go/pkg/mod/github.com/elastic/go-str...@v0.0.7/json/visitor.go:264 +0x514
Mar 08 17:04:29 WC filebeat[15500]: github.com/elastic/go-structform/json.(*Visitor).OnKey(0xc0000fa000, 0x2a017f0, 0x4, 0xc00099f4f8, 0x0)
Mar 08 17:04:29 WC filebeat[15500]:         /go/pkg/mod/github.com/elastic/go-str...@v0.0.7/json/visitor.go:137 +0x60
Mar 08 17:04:29 WC filebeat[15500]: github.com/elastic/go-structform/gotype.foldMapInterface(0xc0000e6f00, 0x270ee40, 0xc0008a2540, 0xc0008a2540, 0x2aede28)
Mar 08 17:04:29 WC filebeat[15500]:         /go/pkg/mod/github.com/elastic/go-str...@v0.0.7/gotype/fold_map.go:52 +0x13b
Mar 08 17:04:29 WC filebeat[15500]: github.com/elastic/go-structform/gotype.foldInterfaceValue(0xc0000e6f00, 0x2912ac0, 0xc0008a2540, 0x0, 0x0)
Mar 08 17:04:29 WC filebeat[15500]:         /go/pkg/mod/github.com/elastic/go-str...@v0.0.7/gotype/fold.go:106 +0x34c
Mar 08 17:04:29 WC filebeat[15500]: github.com/elastic/go-structform/gotype.foldMapInlineInterface(0xc0000e6f00, 0x2912ac0, 0xc00000fb38, 0x95, 0x2912ac0, 0xc00000fb38)
Mar 08 17:04:29 WC filebeat[15500]:         /go/pkg/mod/github.com/elastic/go-str...@v0.0.7/gotype/fold_map_inline.generated.go:61 +0x153
Mar 08 17:04:29 WC filebeat[15500]: github.com/elastic/go-structform/gotype.makeFieldInlineFold.func1(0xc0000e6f00, 0x27c2c40, 0xc00000fb20, 0x99, 0x0, 0x0)
Mar 08 17:04:29 WC filebeat[15500]:         /go/pkg/mod/github.com/elastic/go-str...@v0.0.7/gotype/fold_reflect.go:314 +0x86
Mar 08 17:04:29 WC filebeat[15500]: github.com/elastic/go-structform/gotype.makeFieldsFold.func1(0xc0000e6f00, 0x27c2c40, 0xc00000fb20, 0x99, 0x0, 0x27c2c40)
Mar 08 17:04:29 WC filebeat[15500]:         /go/pkg/mod/github.com/elastic/go-str...@v0.0.7/gotype/fold_reflect.go:194 +0x88
Mar 08 17:04:29 WC filebeat[15500]: github.com/elastic/go-structform/gotype.makeStructFold.func1(0xc0000e6f00, 0x27c2c40, 0xc00000fb20, 0x99, 0x0, 0x0)
Mar 08 17:04:29 WC filebeat[15500]:         /go/pkg/mod/github.com/elastic/go-str...@v0.0.7/gotype/fold_reflect.go:184 +0x95
Mar 08 17:04:29 WC filebeat[15500]: github.com/elastic/go-structform/gotype.foldAnyReflect(0xc0000e6f00, 0x27c2c40, 0xc00000fb20, 0x99, 0x0, 0xc00099f800)
Mar 08 17:04:29 WC systemd[1]: filebeat.service: Main process exited, code=exited, status=2/INVALIDARGUMENT
░░ Subject: Unit process exited
░░ Defined-By: systemd
░░ Support: https://access.redhat.com/support
░░
░░ An ExecStart= process belonging to unit filebeat.service has exited.
░░
░░ The process' exit code is 'exited' and its exit status is 2.
Mar 08 17:04:29 WC filebeat[15500]:         /go/pkg/mod/github.com/elastic/go-str...@v0.0.7/gotype/fold_reflect.go:533 +0xb9
Mar 08 17:04:29 WC filebeat[15500]: github.com/elastic/go-structform/gotype.foldInterfaceValue(0xc0000e6f00, 0x27c2c40, 0xc00000fb20, 0xc00000fb20, 0x0)
Mar 08 17:04:29 WC filebeat[15500]:         /go/pkg/mod/github.com/elastic/go-str...@v0.0.7/gotype/fold.go:109 +0x2d1
Mar 08 17:04:29 WC filebeat[15500]: github.com/elastic/go-structform/gotype.(*Iterator).Fold(...)
Mar 08 17:04:29 WC filebeat[15500]:         /go/pkg/mod/github.com/elastic/go-str...@v0.0.7/gotype/fold.go:86
Mar 08 17:04:29 WC filebeat[15500]: github.com/elastic/beats/v7/libbeat/esleg/eslegclient.(*jsonEncoder).AddRaw(0xc000127060, 0x27e75e0, 0xc000507a60, 0x0, 0x0)
Mar 08 17:04:29 WC filebeat[15500]:         /go/src/github.com/elastic/beats/libbeat/esleg/eslegclient/enc.go:118 +0x180
Mar 08 17:04:29 WC filebeat[15500]: github.com/elastic/beats/v7/libbeat/esleg/eslegclient.bulkEncode(0xc000277ec0, 0x7ffb007bd8d8, 0xc000127060, 0xc000fa8800, 0x64, 0x>
Mar 08 17:04:29 WC filebeat[15500]:         /go/src/github.com/elastic/beats/libbeat/esleg/eslegclient/bulkapi.go:229 +0x8c
Mar 08 17:04:29 WC filebeat[15500]: github.com/elastic/beats/v7/libbeat/esleg/eslegclient.(*Connection).Bulk(0xc000328dc0, 0x2d81f20, 0xc00019c010, 0x0, 0x0, 0x0, 0x0,>
Mar 08 17:04:29 WC filebeat[15500]:         /go/src/github.com/elastic/beats/libbeat/esleg/eslegclient/bulkapi.go:80 +0xf7
Mar 08 17:04:29 WC filebeat[15500]: github.com/elastic/beats/v7/libbeat/outputs/elasticsearch.(*Client).publishEvents(0xc000328dc0, 0x2d81f20, 0xc00019c010, 0xc000506c>
Mar 08 17:04:29 WC filebeat[15500]:         /go/src/github.com/elastic/beats/libbeat/outputs/elasticsearch/client.go:220 +0x42d
Mar 08 17:04:29 WC filebeat[15500]: github.com/elastic/beats/v7/libbeat/outputs/elasticsearch.(*Client).Publish(0xc000328dc0, 0x2d81f20, 0xc00019c010, 0x7ffb005d6128, >
Mar 08 17:04:29 WC filebeat[15500]:         /go/src/github.com/elastic/beats/libbeat/outputs/elasticsearch/client.go:180 +0x81
Mar 08 17:04:29 WC filebeat[15500]: github.com/elastic/beats/v7/libbeat/outputs.(*backoffClient).Publish(0xc0000e6f60, 0x2d81f20, 0xc00019c010, 0x7ffb005d6128, 0xc0015>
Mar 08 17:04:29 WC filebeat[15500]:         /go/src/github.com/elastic/beats/libbeat/outputs/backoff.go:61 +0x5f
Mar 08 17:04:29 WC filebeat[15500]: github.com/elastic/beats/v7/libbeat/publisher/pipeline.(*netClientWorker).publishBatch(0xc0001a2a20, 0x7ffb005d6128, 0xc001519200, >
Mar 08 17:04:29 WC filebeat[15500]:         /go/src/github.com/elastic/beats/libbeat/publisher/pipeline/output.go:176 +0xdf
Mar 08 17:04:29 WC systemd[1]: filebeat.service: Failed with result 'exit-code'.
░░ Subject: Unit failed
░░ Defined-By: systemd
░░ Support: https://access.redhat.com/support
░░
░░ The unit filebeat.service has entered the 'failed' state with result 'exit-code'.
Mar 08 17:04:29 WC filebeat[15500]: github.com/elastic/beats/v7/libbeat/publisher/pipeline.(*netClientWorker).run(0xc0001a2a20)
Mar 08 17:04:29 WC filebeat[15500]:         /go/src/github.com/elastic/beats/libbeat/publisher/pipeline/output.go:161 +0x12e
Mar 08 17:04:29 WC filebeat[15500]: created by github.com/elastic/beats/v7/libbeat/publisher/pipeline.makeClientWorker
Mar 08 17:04:29 WC filebeat[15500]:         /go/src/github.com/elastic/beats/libbeat/publisher/pipeline/output.go:79 +0x194
Mar 08 17:04:29 WC filebeat[15500]: goroutine 74 [select]:
Mar 08 17:04:29 WC filebeat[15500]: github.com/elastic/beats/v7/filebeat/channel.CloseOnSignal.func1(0x2d6c5a0, 0xc0008b0d20, 0xc000124120)
Mar 08 17:04:29 WC filebeat[15500]:         /go/src/github.com/elastic/beats/filebeat/channel/util.go:112 +0xb7
Mar 08 17:04:29 WC filebeat[15500]: created by github.com/elastic/beats/v7/filebeat/channel.CloseOnSignal
Mar 08 17:04:29 WC filebeat[15500]:         /go/src/github.com/elastic/beats/filebeat/channel/util.go:111 +0x76
Mar 08 17:04:29 WC filebeat[15500]: goroutine 73 [select]:
Mar 08 17:04:29 WC filebeat[15500]: github.com/elastic/beats/v7/filebeat/registrar.(*Registrar).Run(0xc0003184e0)
Mar 08 17:04:29 WC filebeat[15500]:         /go/src/github.com/elastic/beats/filebeat/registrar/registrar.go:164 +0x2ae
Mar 08 17:04:29 WC filebeat[15500]: github.com/elastic/beats/v7/filebeat/registrar.(*Registrar).Start.func1(0xc0003184e0)
Mar 08 17:04:29 WC filebeat[15500]:         /go/src/github.com/elastic/beats/filebeat/registrar/registrar.go:124 +0x54
Mar 08 17:04:29 WC filebeat[15500]: created by github.com/elastic/beats/v7/filebeat/registrar.(*Registrar).Start
Mar 08 17:04:29 WC filebeat[15500]:         /go/src/github.com/elastic/beats/filebeat/registrar/registrar.go:122 +0xe8
Mar 08 17:04:29 WC filebeat[15500]: goroutine 91 [select]:
Mar 08 17:04:29 WC filebeat[15500]: github.com/elastic/beats/v7/libbeat/monitoring/report/log.(*reporter).snapshotLoop(0xc00032e4b0)
Mar 08 17:04:29 WC filebeat[15500]:         /go/src/github.com/elastic/beats/libbeat/monitoring/report/log/log.go:129 +0x3cb
Mar 08 17:04:29 WC filebeat[15500]: github.com/elastic/beats/v7/libbeat/monitoring/report/log.MakeReporter.func1(0xc00032e4b0)
Mar 08 17:04:29 WC filebeat[15500]:         /go/src/github.com/elastic/beats/libbeat/monitoring/report/log/log.go:107 +0x50
Mar 08 17:04:29 WC filebeat[15500]: created by github.com/elastic/beats/v7/libbeat/monitoring/report/log.MakeReporter
Mar 08 17:04:29 WC filebeat[15500]:         /go/src/github.com/elastic/beats/libbeat/monitoring/report/log/log.go:105 +0x157
Mar 08 17:04:29 WC filebeat[15500]: goroutine 92 [syscall]:
Mar 08 17:04:29 WC filebeat[15500]: os/signal.signal_recv(0x0)
Mar 08 17:04:29 WC filebeat[15500]:         /usr/local/go/src/runtime/sigqueue.go:147 +0x9c
Mar 08 17:04:29 WC filebeat[15500]: os/signal.loop()
Mar 08 17:04:29 WC filebeat[15500]:         /usr/local/go/src/os/signal/signal_unix.go:23 +0x22
Mar 08 17:04:29 WC filebeat[15500]: created by os/signal.Notify.func1
Mar 08 17:04:29 WC filebeat[15500]:         /usr/local/go/src/os/signal/signal.go:127 +0x44
Mar 08 17:04:29 WC filebeat[15500]: goroutine 26 [chan receive]:
Mar 08 17:04:29 WC filebeat[15500]: github.com/elastic/beats/v7/libbeat/service.HandleSignals.func1(0xc0005fc060, 0xc00032c960, 0xc00032c950, 0xc000052fb0, 0xc00000f38>
Mar 08 17:04:29 WC filebeat[15500]:         /go/src/github.com/elastic/beats/libbeat/service/service.go:50 +0x52
Mar 08 17:04:29 WC filebeat[15500]: created by github.com/elastic/beats/v7/libbeat/service.HandleSignals
Mar 08 17:04:29 WC filebeat[15500]:         /go/src/github.com/elastic/beats/libbeat/service/service.go:49 +0x172
Mar 08 17:04:29 WC filebeat[15500]: goroutine 72 [select]:
Mar 08 17:04:29 WC filebeat[15500]: github.com/elastic/go-concert/timed.Periodic(0x7ffb007bd4b0, 0xc0002fa4c0, 0x45d964b800, 0xc000078e98, 0x0, 0x0)
Mar 08 17:04:29 WC filebeat[15500]:         /go/pkg/mod/github.com/elastic/go-co...@v0.0.4/timed/timed.go:76 +0x13a
Mar 08 17:04:29 WC filebeat[15500]: github.com/elastic/beats/v7/filebeat/input/filestream/internal/input-logfile.(*cleaner).run(0xc00061a078, 0x7ffb007bd488, 0xc0002fa>
Mar 08 17:04:29 WC filebeat[15500]:         /go/src/github.com/elastic/beats/filebeat/input/filestream/internal/input-logfile/clean.go:47 +0xce
Mar 08 17:04:29 WC filebeat[15500]: github.com/elastic/beats/v7/filebeat/input/filestream/internal/input-logfile.(*InputManager).Init.func1(0x7ffb007bd488, 0xc0002fa4c>
Mar 08 17:04:29 WC filebeat[15500]:         /go/src/github.com/elastic/beats/filebeat/input/filestream/internal/input-logfile/manager.go:130 +0xd9
Mar 08 17:04:29 WC filebeat[15500]: github.com/elastic/go-concert/unison.(*TaskGroup).Go.func1(0xc000618480, 0xc0008b0360)
Mar 08 17:04:29 WC filebeat[15500]:         /go/pkg/mod/github.com/elastic/go-co...@v0.0.4/unison/taskgroup.go:110 +0x99
Mar 08 17:04:29 WC filebeat[15500]: created by github.com/elastic/go-concert/unison.(*TaskGroup).Go
Mar 08 17:04:29 WC filebeat[15500]:         /go/pkg/mod/github.com/elastic/go-co...@v0.0.4/unison/taskgroup.go:108 +0x9b
Mar 08 17:04:29 WC filebeat[15500]: goroutine 76 [select]:
Mar 08 17:04:29 WC filebeat[15500]: github.com/elastic/beats/v7/filebeat/channel.CloseOnSignal.func1(0x2d6c5e0, 0xc0008a2660, 0xc0001805a0)
Mar 08 17:04:29 WC filebeat[15500]:         /go/src/github.com/elastic/beats/filebeat/channel/util.go:112 +0xb7
Mar 08 17:04:29 WC filebeat[15500]: created by github.com/elastic/beats/v7/filebeat/channel.CloseOnSignal
Mar 08 17:04:29 WC filebeat[15500]:         /go/src/github.com/elastic/beats/filebeat/channel/util.go:111 +0x76
Mar 08 17:04:29 WC filebeat[15500]: goroutine 77 [select]:
Mar 08 17:04:29 WC filebeat[15500]: github.com/elastic/beats/v7/filebeat/input/log.(*Input).stopWhenDone(0xc0005e61c0)
Mar 08 17:04:29 WC filebeat[15500]:         /go/src/github.com/elastic/beats/filebeat/input/log/input.go:790 +0x11c
Mar 08 17:04:29 WC filebeat[15500]: created by github.com/elastic/beats/v7/filebeat/input/log.NewInput
Mar 08 17:04:29 WC filebeat[15500]:         /go/src/github.com/elastic/beats/filebeat/input/log/input.go:160 +0x942
Mar 08 17:04:29 WC filebeat[15500]: goroutine 78 [select]:
Mar 08 17:04:29 WC filebeat[15500]: github.com/elastic/beats/v7/filebeat/input.(*Runner).Run(0xc000319260)
Mar 08 17:04:29 WC filebeat[15500]:         /go/src/github.com/elastic/beats/filebeat/input/input.go:134 +0x144
Mar 08 17:04:29 WC filebeat[15500]: github.com/elastic/beats/v7/filebeat/input.(*Runner).Start.func1(0xc0008ab890, 0xc000319260)
Mar 08 17:04:29 WC filebeat[15500]:         /go/src/github.com/elastic/beats/filebeat/input/input.go:119 +0x61
Mar 08 17:04:29 WC filebeat[15500]: created by github.com/elastic/beats/v7/filebeat/input.(*Runner).Start
Mar 08 17:04:29 WC filebeat[15500]:         /go/src/github.com/elastic/beats/filebeat/input/input.go:112 +0xef
Mar 08 17:04:29 WC filebeat[15500]: goroutine 79 [chan receive]:
Mar 08 17:04:29 WC filebeat[15500]: github.com/elastic/beats/v7/filebeat/beater.waitChannel.func1()
Mar 08 17:04:29 WC filebeat[15500]:         /go/src/github.com/elastic/beats/filebeat/beater/signalwait.go:79 +0x33
Mar 08 17:04:29 WC filebeat[15500]: github.com/elastic/beats/v7/filebeat/beater.(*signalWait).Add.func1(0xc00057e470, 0xc00002c040)
Mar 08 17:04:29 WC filebeat[15500]:         /go/src/github.com/elastic/beats/filebeat/beater/signalwait.go:52 +0x27
Mar 08 17:04:29 WC filebeat[15500]: created by github.com/elastic/beats/v7/filebeat/beater.(*signalWait).Add
Mar 08 17:04:29 WC filebeat[15500]:         /go/src/github.com/elastic/beats/filebeat/beater/signalwait.go:51 +0x4c
Mar 08 17:04:29 WC filebeat[15500]: goroutine 94 [runnable]:
Mar 08 17:04:29 WC filebeat[15500]: syscall.Syscall(0x0, 0x8, 0xc001990000, 0x4000, 0x4000, 0x4000, 0x0)
Mar 08 17:04:29 WC filebeat[15500]:         /usr/local/go/src/syscall/asm_linux_amd64.s:18 +0x5
Mar 08 17:04:29 WC filebeat[15500]: syscall.read(0x8, 0xc001990000, 0x4000, 0x4000, 0x0, 0xc000cfa820, 0x0)
Mar 08 17:04:29 WC filebeat[15500]:         /usr/local/go/src/syscall/zsyscall_linux_amd64.go:686 +0x5a
Mar 08 17:04:29 WC filebeat[15500]: syscall.Read(...)
Mar 08 17:04:29 WC filebeat[15500]:         /usr/local/go/src/syscall/syscall_unix.go:189
Mar 08 17:04:29 WC filebeat[15500]: internal/poll.(*FD).Read(0xc00009eae0, 0xc001990000, 0x4000, 0x4000, 0x0, 0x0, 0x0)
Mar 08 17:04:29 WC filebeat[15500]:         /usr/local/go/src/internal/poll/fd_unix.go:165 +0x133
Mar 08 17:04:29 WC filebeat[15500]: os.(*File).read(...)
Mar 08 17:04:29 WC filebeat[15500]:         /usr/local/go/src/os/file_unix.go:263
Mar 08 17:04:29 WC filebeat[15500]: os.(*File).Read(0xc0001a0190, 0xc001990000, 0x4000, 0x4000, 0x0, 0x0, 0x0)
Mar 08 17:04:29 WC filebeat[15500]:         /usr/local/go/src/os/file.go:116 +0x71
Mar 08 17:04:29 WC filebeat[15500]: github.com/elastic/beats/v7/filebeat/input/log.(*Log).Read(0xc0001cf420, 0xc001990000, 0x4000, 0x4000, 0x1, 0xffffffffffffffff, 0x2)
Mar 08 17:04:29 WC filebeat[15500]:         /go/src/github.com/elastic/beats/filebeat/input/log/log.go:81 +0x1c3
Mar 08 17:04:29 WC filebeat[15500]: github.com/elastic/beats/v7/libbeat/reader/readfile.(*LineReader).advance(0xc0004101b0, 0x0, 0x0)
Mar 08 17:04:29 WC filebeat[15500]:         /go/src/github.com/elastic/beats/libbeat/reader/readfile/line.go:139 +0x39f
Mar 08 17:04:29 WC filebeat[15500]: github.com/elastic/beats/v7/libbeat/reader/readfile.(*LineReader).Next(0xc0004101b0, 0x244b036, 0xc00088fe08, 0xc081edb17051c5b2, 0>
Mar 08 17:04:29 WC filebeat[15500]:         /go/src/github.com/elastic/beats/libbeat/reader/readfile/line.go:84 +0x40
Mar 08 17:04:29 WC filebeat[15500]: github.com/elastic/beats/v7/libbeat/reader/readfile.EncoderReader.Next(0xc0004101b0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc001>
Mar 08 17:04:29 WC filebeat[15500]:         /go/src/github.com/elastic/beats/libbeat/reader/readfile/encode.go:54 +0x63
Mar 08 17:04:29 WC filebeat[15500]: github.com/elastic/beats/v7/libbeat/reader/readfile.(*StripNewline).Next(0xc00032ef60, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18>
Mar 08 17:04:29 WC filebeat[15500]:         /go/src/github.com/elastic/beats/libbeat/reader/readfile/strip_newline.go:50 +0x6b
Mar 08 17:04:29 WC filebeat[15500]: github.com/elastic/beats/v7/libbeat/reader/readfile.(*LimitReader).Next(0xc000126fa0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc00>
Mar 08 17:04:29 WC filebeat[15500]:         /go/src/github.com/elastic/beats/libbeat/reader/readfile/limit.go:40 +0x6b
Mar 08 17:04:29 WC filebeat[15500]: github.com/elastic/beats/v7/filebeat/input/log.(*Harvester).Run(0xc00030e2c0, 0x0, 0x0)
Mar 08 17:04:29 WC filebeat[15500]:         /go/src/github.com/elastic/beats/filebeat/input/log/harvester.go:317 +0x397
Mar 08 17:04:29 WC filebeat[15500]: github.com/elastic/beats/v7/filebeat/harvester.(*Registry).Start.func1(0xc0002fa800, 0x2d6c7e0, 0xc00030e2c0)
Mar 08 17:04:29 WC filebeat[15500]:         /go/src/github.com/elastic/beats/filebeat/harvester/registry.go:96 +0x6f
Mar 08 17:04:29 WC filebeat[15500]: created by github.com/elastic/beats/v7/filebeat/harvester.(*Registry).Start
Mar 08 17:04:29 WC filebeat[15500]:         /go/src/github.com/elastic/beats/filebeat/harvester/registry.go:90 +0x121
Mar 08 17:04:29 WC filebeat[15500]: goroutine 95 [chan receive]:
Mar 08 17:04:29 WC filebeat[15500]: github.com/elastic/beats/v7/filebeat/channel.SubOutlet.func1(0xc00032f020, 0x2d6c5a0, 0xc0008b0d20)
Mar 08 17:04:29 WC filebeat[15500]:         /go/src/github.com/elastic/beats/filebeat/channel/util.go:44 +0x150
Mar 08 17:04:29 WC filebeat[15500]: created by github.com/elastic/beats/v7/filebeat/channel.SubOutlet
Mar 08 17:04:29 WC filebeat[15500]:         /go/src/github.com/elastic/beats/filebeat/channel/util.go:43 +0xf8
Mar 08 17:04:29 WC filebeat[15500]: goroutine 96 [select]:
Mar 08 17:04:29 WC filebeat[15500]: github.com/elastic/beats/v7/filebeat/channel.CloseOnSignal.func1(0x2d6c5e0, 0xc00032f020, 0xc000180360)
Mar 08 17:04:29 WC filebeat[15500]:         /go/src/github.com/elastic/beats/filebeat/channel/util.go:112 +0xb7
Mar 08 17:04:29 WC filebeat[15500]: created by github.com/elastic/beats/v7/filebeat/channel.CloseOnSignal
Mar 08 17:04:29 WC filebeat[15500]:         /go/src/github.com/elastic/beats/filebeat/channel/util.go:111 +0x76
Mar 08 17:04:29 WC filebeat[15500]: goroutine 97 [select]:
Mar 08 17:04:29 WC filebeat[15500]: github.com/elastic/beats/v7/filebeat/input/log.(*Harvester).Run.func2(0xc00030e2c0, 0xc0000577d0, 0x22)
Mar 08 17:04:29 WC filebeat[15500]:         /go/src/github.com/elastic/beats/filebeat/input/log/harvester.go:287 +0xd3
Mar 08 17:04:29 WC filebeat[15500]: created by github.com/elastic/beats/v7/filebeat/input/log.(*Harvester).Run
Mar 08 17:04:29 WC filebeat[15500]:         /go/src/github.com/elastic/beats/filebeat/input/log/harvester.go:280 +0x282
Mar 08 17:04:29 WC filebeat[15500]: goroutine 98 [select]:
Mar 08 17:04:29 WC filebeat[15500]: github.com/elastic/beats/v7/filebeat/input/log.(*Harvester).monitorFileSize(0xc00030e2c0)
Mar 08 17:04:29 WC filebeat[15500]:         /go/src/github.com/elastic/beats/filebeat/input/log/harvester.go:371 +0xfb
Mar 08 17:04:29 WC filebeat[15500]: github.com/elastic/beats/v7/filebeat/input/log.(*Harvester).Run.func3(0xc00030e2c0)
Mar 08 17:04:29 WC filebeat[15500]:         /go/src/github.com/elastic/beats/filebeat/input/log/harvester.go:306 +0x2b
Mar 08 17:04:29 WC filebeat[15500]: created by github.com/elastic/beats/v7/filebeat/input/log.(*Harvester).Run
Mar 08 17:04:29 WC filebeat[15500]:         /go/src/github.com/elastic/beats/filebeat/input/log/harvester.go:305 +0x34b
Mar 08 17:04:29 WC filebeat[15500]: goroutine 28 [IO wait]:
Mar 08 17:04:29 WC filebeat[15500]: internal/poll.runtime_pollWait(0x7ffb017f8078, 0x72, 0xffffffffffffffff)
Mar 08 17:04:29 WC filebeat[15500]:         /usr/local/go/src/runtime/netpoll.go:203 +0x55
Mar 08 17:04:29 WC filebeat[15500]: internal/poll.(*pollDesc).wait(0xc000618698, 0x72, 0x3900, 0x3919, 0xffffffffffffffff)
Mar 08 17:04:29 WC filebeat[15500]:         /usr/local/go/src/internal/poll/fd_poll_runtime.go:87 +0x45
Mar 08 17:04:29 WC filebeat[15500]: internal/poll.(*pollDesc).waitRead(...)
Mar 08 17:04:29 WC filebeat[15500]:         /usr/local/go/src/internal/poll/fd_poll_runtime.go:92
Mar 08 17:04:29 WC filebeat[15500]: internal/poll.(*FD).Read(0xc000618680, 0xc00182c000, 0x3919, 0x3919, 0x0, 0x0, 0x0)
Mar 08 17:04:29 WC filebeat[15500]:         /usr/local/go/src/internal/poll/fd_unix.go:169 +0x19b
Mar 08 17:04:29 WC filebeat[15500]: net.(*netFD).Read(0xc000618680, 0xc00182c000, 0x3919, 0x3919, 0x203000, 0x1242340, 0xc0002ee4b8)
Mar 08 17:04:29 WC filebeat[15500]:         /usr/local/go/src/net/fd_unix.go:202 +0x4f
Mar 08 17:04:29 WC filebeat[15500]: net.(*conn).Read(0xc0001a00b0, 0xc00182c000, 0x3919, 0x3919, 0x0, 0x0, 0x0)
Mar 08 17:04:29 WC filebeat[15500]:         /usr/local/go/src/net/net.go:184 +0x8e
Mar 08 17:04:29 WC filebeat[15500]: crypto/tls.(*atLeastReader).Read(0xc00000f460, 0xc00182c000, 0x3919, 0x3919, 0x2c0a, 0xc00041e134, 0xc0005738a0)
Mar 08 17:04:29 WC filebeat[15500]:         /usr/local/go/src/crypto/tls/conn.go:760 +0x60
Mar 08 17:04:29 WC filebeat[15500]: bytes.(*Buffer).ReadFrom(0xc0002ee5d8, 0x2d27a00, 0xc00000f460, 0xed47e5, 0x274ac20, 0x29541a0)
Mar 08 17:04:29 WC filebeat[15500]:         /usr/local/go/src/bytes/buffer.go:204 +0xb1
Mar 08 17:04:29 WC filebeat[15500]: crypto/tls.(*Conn).readFromUntil(0xc0002ee380, 0x2d2aa40, 0xc0001a00b0, 0x5, 0xc0001a00b0, 0x40)
Mar 08 17:04:29 WC filebeat[15500]:         /usr/local/go/src/crypto/tls/conn.go:782 +0xec
Mar 08 17:04:29 WC filebeat[15500]: crypto/tls.(*Conn).readRecordOrCCS(0xc0002ee380, 0x0, 0x0, 0x0)
Mar 08 17:04:29 WC filebeat[15500]:         /usr/local/go/src/crypto/tls/conn.go:589 +0x115
Mar 08 17:04:29 WC filebeat[15500]: crypto/tls.(*Conn).readRecord(...)
Mar 08 17:04:29 WC filebeat[15500]:         /usr/local/go/src/crypto/tls/conn.go:557
Mar 08 17:04:29 WC filebeat[15500]: crypto/tls.(*Conn).Read(0xc0002ee380, 0xc00041e000, 0x1000, 0x1000, 0x0, 0x0, 0x0)
Mar 08 17:04:29 WC filebeat[15500]:         /usr/local/go/src/crypto/tls/conn.go:1233 +0x15b
Mar 08 17:04:29 WC filebeat[15500]: github.com/elastic/beats/v7/libbeat/common/transport.(*statsConn).Read(0xc0008c3540, 0xc00041e000, 0x1000, 0x1000, 0xecf671, 0xc000>
Mar 08 17:04:29 WC filebeat[15500]:         /go/src/github.com/elastic/beats/libbeat/common/transport/stats.go:44 +0x55
Mar 08 17:04:29 WC filebeat[15500]: net/http.(*persistConn).Read(0xc000e1e120, 0xc00041e000, 0x1000, 0x1000, 0xc000180960, 0xc000573c58, 0xecf145)
Mar 08 17:04:29 WC filebeat[15500]:         /usr/local/go/src/net/http/transport.go:1884 +0x75
Mar 08 17:04:29 WC filebeat[15500]: bufio.(*Reader).fill(0xc0005f39e0)
Mar 08 17:04:29 WC filebeat[15500]:         /usr/local/go/src/bufio/bufio.go:100 +0x103
Mar 08 17:04:29 WC filebeat[15500]: bufio.(*Reader).Peek(0xc0005f39e0, 0x1, 0x0, 0x0, 0x1, 0x0, 0xc0001813e0)
Mar 08 17:04:29 WC filebeat[15500]:         /usr/local/go/src/bufio/bufio.go:138 +0x4f
Mar 08 17:04:29 WC filebeat[15500]: net/http.(*persistConn).readLoop(0xc000e1e120)
Mar 08 17:04:29 WC filebeat[15500]:         /usr/local/go/src/net/http/transport.go:2037 +0x1a8
Mar 08 17:04:29 WC filebeat[15500]: created by net/http.(*Transport).dialConn
Mar 08 17:04:29 WC filebeat[15500]:         /usr/local/go/src/net/http/transport.go:1706 +0xc56
Mar 08 17:04:29 WC filebeat[15500]: goroutine 29 [select]:
Mar 08 17:04:29 WC filebeat[15500]: net/http.(*persistConn).writeLoop(0xc000e1e120)
Mar 08 17:04:29 WC filebeat[15500]:         /usr/local/go/src/net/http/transport.go:2336 +0x11c
Mar 08 17:04:29 WC filebeat[15500]: created by net/http.(*Transport).dialConn
Mar 08 17:04:29 WC filebeat[15500]:         /usr/local/go/src/net/http/transport.go:1707 +0xc7b
Mar 08 17:04:29 WC filebeat[15500]: rax    0x0
Mar 08 17:04:29 WC filebeat[15500]: rbx    0x7ffb02834640
Mar 08 17:04:29 WC filebeat[15500]: rcx    0x7ffb2956f43c
Mar 08 17:04:29 WC filebeat[15500]: rdx    0x6
Mar 08 17:04:29 WC filebeat[15500]: rdi    0x3c8c
Mar 08 17:04:29 WC filebeat[15500]: rsi    0x3c8d
Mar 08 17:04:29 WC filebeat[15500]: rbp    0x3c8d
Mar 08 17:04:29 WC filebeat[15500]: rsp    0x7ffb02833760
Mar 08 17:04:29 WC filebeat[15500]: r8     0x7ffb02833830
Mar 08 17:04:29 WC filebeat[15500]: r9     0x7ffb2967f4e0
Mar 08 17:04:29 WC filebeat[15500]: r10    0x8
Mar 08 17:04:29 WC filebeat[15500]: r11    0x246
Mar 08 17:04:29 WC filebeat[15500]: r12    0x6
Mar 08 17:04:29 WC filebeat[15500]: r13    0x0
Mar 08 17:04:29 WC filebeat[15500]: r14    0x2cf0118
Mar 08 17:04:29 WC filebeat[15500]: r15    0x0
Mar 08 17:04:29 WC filebeat[15500]: rip    0x7ffb2956f43c
Mar 08 17:04:29 WC filebeat[15500]: rflags 0x246
Mar 08 17:04:29 WC filebeat[15500]: cs     0x33
Mar 08 17:04:29 WC filebeat[15500]: fs     0x0
Mar 08 17:04:29 WC filebeat[15500]: gs     0x0
Mar 08 17:04:30 WC systemd[1]: filebeat.service: Scheduled restart job, restart counter is at 2.
░░ Subject: Automatic restarting of a unit has been scheduled
░░ Defined-By: systemd
░░ Support: https://access.redhat.com/support
░░
░░ Automatic restarting of the unit filebeat.service has been scheduled, as the result for
░░ the configured Restart= setting for the unit.
Mar 08 17:04:30 WC systemd[1]: Stopped Filebeat sends log files to Logstash or directly to Elasticsearch..
░░ Subject: A stop job for unit filebeat.service has finished
░░ Defined-By: systemd
░░ Support: https://access.redhat.com/support
░░
░░ A stop job for unit filebeat.service has finished.
░░
░░ The job identifier is 12062 and the job result is done.
Mar 08 17:04:30 WC systemd[1]: Started Filebeat sends log files to Logstash or directly to Elasticsearch..
░░ Subject: A start job for unit filebeat.service has finished successfully
░░ Defined-By: systemd
░░ Support: https://access.redhat.com/support
░░
░░ A start job for unit filebeat.service has finished successfully.
░░
░░ The job identifier is 12062.
Mar 08 17:04:30 WC filebeat[15509]: 2022-03-08T17:04:30.101+0530        INFO        instance/beat.go:645        Home path: [/usr/share/filebeat] Config path: [/etc/fil>
Mar 08 17:04:30 WC filebeat[15509]: 2022-03-08T17:04:30.101+0530        INFO        instance/beat.go:653        Beat ID: 3d0668f2-7e97-49bf-80b0-dedb88a541e4
Mar 08 17:04:30 WC filebeat[15509]: 2022-03-08T17:04:30.101+0530        INFO        [seccomp]        seccomp/seccomp.go:124        Syscall filter successfully installed
Mar 08 17:04:30 WC filebeat[15509]: 2022-03-08T17:04:30.101+0530        INFO        [beat]        instance/beat.go:981        Beat info        {"system_info": {"beat":>
Mar 08 17:04:30 WC filebeat[15509]: 2022-03-08T17:04:30.101+0530        INFO        [beat]        instance/beat.go:990        Build info        {"system_info": {"build>
Mar 08 17:04:30 WC filebeat[15509]: 2022-03-08T17:04:30.101+0530        INFO        [beat]        instance/beat.go:993        Go runtime info        {"system_info": {">
Mar 08 17:04:30 WC filebeat[15509]: 2022-03-08T17:04:30.102+0530        INFO        [beat]        instance/beat.go:997        Host info        {"system_info": {"host":>
Mar 08 17:04:30 WC filebeat[15509]: 2022-03-08T17:04:30.102+0530        INFO        [beat]        instance/beat.go:1026        Process info        {"system_info": {"pr>
Mar 08 17:04:30 WC filebeat[15509]: 2022-03-08T17:04:30.102+0530        INFO        instance/beat.go:299        Setup Beat: filebeat; Version: 7.10.2
Mar 08 17:04:30 WC filebeat[15509]: 2022-03-08T17:04:30.102+0530        INFO        eslegclient/connection.go:99        elasticsearch url: https://127.0.0.1:9200
Mar 08 17:04:30 WC filebeat[15509]: 2022-03-08T17:04:30.103+0530        INFO        [publisher]        pipeline/module.go:113        Beat name: WC
Mar 08 17:04:30 WC filebeat[15509]: 2022-03-08T17:04:30.104+0530        INFO        beater/filebeat.go:117        Enabled modules/filesets: wazuh (alerts),  ()
Mar 08 17:04:30 WC filebeat[15509]: 2022-03-08T17:04:30.104+0530        INFO        [monitoring]        log/log.go:118        Starting metrics logging every 30s
Mar 08 17:04:30 WC filebeat[15509]: runtime/cgo: pthread_create failed: Operation not permitted2022-03-08T17:04:30.104+0530        INFO        instance/beat.go:455    >
Mar 08 17:04:30 WC filebeat[15509]: SIGABRT: abort
Mar 08 17:04:30 WC filebeat[15509]: PC=0x7f301c24d43c m=6 sigcode=18446744073709551610
Mar 08 17:04:30 WC filebeat[15509]: goroutine 0 [idle]:
Mar 08 17:04:30 WC filebeat[15509]: runtime: unknown pc 0x7f301c24d43c
Mar 08 17:04:30 WC filebeat[15509]: stack: frame={sp:0x7f2feeffc8a0, fp:0x0} stack=[0x7f2fee7fd1e8,0x7f2feeffcde8)
Mar 08 17:04:30 WC filebeat[15509]: 00007f2feeffc7a0:  0000000000000000  0000000000000000
Mar 08 17:04:30 WC filebeat[15509]: 00007f2feeffc7b0:  0000000000000000  0000000000000000
Mar 08 17:04:30 WC filebeat[15509]: 00007f2feeffc7c0:  0000000000000000  0000000000000000
Mar 08 17:04:30 WC filebeat[15509]: 00007f2feeffc7d0:  0000000000000000  0000000000000000
Mar 08 17:04:30 WC filebeat[15509]: 00007f2feeffc7e0:  0000000000000000  0000000000000000
Mar 08 17:04:30 WC filebeat[15509]: 00007f2feeffc7f0:  0000000000000000  0000000000000000
Mar 08 17:04:30 WC filebeat[15509]: 00007f2feeffc800:  0000000000000000  0000000000000000
Mar 08 17:04:30 WC filebeat[15509]: 00007f2feeffc810:  0000000000000000  0000000000000000
Mar 08 17:04:30 WC filebeat[15509]: 00007f2feeffc820:  0000000000000000  0000000000000000
Mar 08 17:04:30 WC filebeat[15509]: 00007f2feeffc830:  0000000000000000  0000000000000000
Mar 08 17:04:30 WC filebeat[15509]: 00007f2feeffc840:  0000000000000000  0000000000000000
Mar 08 17:04:30 WC filebeat[15509]: 00007f2feeffc850:  0000000000000000  0000000000000000
Mar 08 17:04:30 WC filebeat[15509]: 00007f2feeffc860:  0000000000000000  0000000000000000
Mar 08 17:04:30 WC filebeat[15509]: 00007f2feeffc870:  0000000000000000  0000000000000000
Mar 08 17:04:30 WC filebeat[15509]: 00007f2feeffc880:  0000000000000000  00007f301c25aa49
Mar 08 17:04:30 WC filebeat[15509]: 00007f2feeffc890:  0000000000000000  00007f301c24d42e
Mar 08 17:04:30 WC filebeat[15509]: 00007f2feeffc8a0: <0000000000000130  0000000000000000
Mar 08 17:04:30 WC filebeat[15509]: 00007f2feeffc8b0:  0000000000000120  0000000000000000
Mar 08 17:04:30 WC filebeat[15509]: 00007f2feeffc8c0:  0000000000000013  0000000000000000
Mar 08 17:04:30 WC filebeat[15509]: 00007f2feeffc8d0:  0000000000000000  0000000000000004
Mar 08 17:04:30 WC filebeat[15509]: 00007f2feeffc8e0:  0000003400000013  00007f301c2fb6d1
Mar 08 17:04:30 WC filebeat[15509]: 00007f2feeffc8f0:  00007f2fed7fa640  00007f2feeffcbb0
Mar 08 17:04:30 WC filebeat[15509]: 00007f2feeffc900:  00007f2feeffca2e  00007f2feeffca2f
Mar 08 17:04:30 WC filebeat[15509]: 00007f2feeffc910:  00007f2fed7fa640  00007f301c24b2f5
Mar 08 17:04:30 WC filebeat[15509]: 00007f2feeffc920:  00007f2fe0000020  63bb966f307a4100
Mar 08 17:04:30 WC filebeat[15509]: 00007f2feeffc930:  00007f2feeffd640  0000000000000006
Mar 08 17:04:30 WC filebeat[15509]: 00007f2feeffc940:  00000000042e96d0  0000000000000016
Mar 08 17:04:30 WC filebeat[15509]: 00007f2feeffc950:  00007f301c24b3f0  00007f301c200d06
Mar 08 17:04:30 WC filebeat[15509]: 00007f2feeffc960:  00007f301c3a3990  00007f301c1d37d3
Mar 08 17:04:30 WC filebeat[15509]: 00007f2feeffc970:  0000000000000020  0000000000000000
Mar 08 17:04:30 WC filebeat[15509]: 00007f2feeffc980:  0000000000000000  00007f301c2eb174
Mar 08 17:04:30 WC filebeat[15509]: 00007f2feeffc990:  00007f2fecffa000  000000000000000d
Mar 08 17:04:30 WC filebeat[15509]: runtime: unknown pc 0x7f301c24d43c
Mar 08 17:04:30 WC filebeat[15509]: stack: frame={sp:0x7f2feeffc8a0, fp:0x0} stack=[0x7f2fee7fd1e8,0x7f2feeffcde8)
Mar 08 17:04:30 WC filebeat[15509]: 00007f2feeffc7a0:  0000000000000000  0000000000000000
Mar 08 17:04:30 WC filebeat[15509]: 00007f2feeffc7b0:  0000000000000000  0000000000000000
Mar 08 17:04:30 WC filebeat[15509]: 00007f2feeffc7c0:  0000000000000000  0000000000000000
Mar 08 17:04:30 WC filebeat[15509]: 00007f2feeffc7d0:  0000000000000000  0000000000000000
Mar 08 17:04:30 WC filebeat[15509]: 00007f2feeffc7e0:  0000000000000000  0000000000000000
Mar 08 17:04:30 WC filebeat[15509]: 00007f2feeffc7f0:  0000000000000000  0000000000000000
Mar 08 17:04:30 WC filebeat[15509]: 00007f2feeffc800:  0000000000000000  0000000000000000
Mar 08 17:04:30 WC filebeat[15509]: 00007f2feeffc810:  0000000000000000  0000000000000000
Mar 08 17:04:30 WC filebeat[15509]: 00007f2feeffc820:  0000000000000000  0000000000000000
Mar 08 17:04:30 WC filebeat[15509]: 00007f2feeffc830:  0000000000000000  0000000000000000
Mar 08 17:04:30 WC filebeat[15509]: 00007f2feeffc840:  0000000000000000  0000000000000000
Mar 08 17:04:30 WC filebeat[15509]: 00007f2feeffc850:  0000000000000000  0000000000000000
Mar 08 17:04:30 WC filebeat[15509]: 00007f2feeffc860:  0000000000000000  0000000000000000
Mar 08 17:04:30 WC filebeat[15509]: 00007f2feeffc870:  0000000000000000  0000000000000000
Mar 08 17:04:30 WC filebeat[15509]: 00007f2feeffc880:  0000000000000000  00007f301c25aa49
Mar 08 17:04:30 WC filebeat[15509]: 00007f2feeffc890:  0000000000000000  00007f301c24d42e
Mar 08 17:04:30 WC filebeat[15509]: 00007f2feeffc8a0: <0000000000000130  0000000000000000
Mar 08 17:04:30 WC filebeat[15509]: 00007f2feeffc8b0:  0000000000000120  0000000000000000
Mar 08 17:04:30 WC filebeat[15509]: 00007f2feeffc8c0:  0000000000000013  0000000000000000
Mar 08 17:04:30 WC filebeat[15509]: 00007f2feeffc8d0:  0000000000000000  0000000000000004
Mar 08 17:04:30 WC filebeat[15509]: 00007f2feeffc8e0:  0000003400000013  00007f301c2fb6d1
Mar 08 17:04:30 WC filebeat[15509]: 00007f2feeffc8f0:  00007f2fed7fa640  00007f2feeffcbb0
Mar 08 17:04:30 WC filebeat[15509]: 00007f2feeffc900:  00007f2feeffca2e  00007f2feeffca2f
Mar 08 17:04:30 WC filebeat[15509]: 00007f2feeffc910:  00007f2fed7fa640  00007f301c24b2f5
Mar 08 17:04:30 WC filebeat[15509]: 00007f2feeffc920:  00007f2fe0000020  63bb966f307a4100
Mar 08 17:04:30 WC filebeat[15509]: 00007f2feeffc930:  00007f2feeffd640  0000000000000006
Mar 08 17:04:30 WC filebeat[15509]: 00007f2feeffc940:  00000000042e96d0  0000000000000016
Mar 08 17:04:30 WC filebeat[15509]: 00007f2feeffc950:  00007f301c24b3f0  00007f301c200d06
Mar 08 17:04:30 WC filebeat[15509]: 00007f2feeffc960:  00007f301c3a3990  00007f301c1d37d3
Mar 08 17:04:30 WC filebeat[15509]: 00007f2feeffc970:  0000000000000020  0000000000000000
Mar 08 17:04:30 WC filebeat[15509]: 00007f2feeffc980:  0000000000000000  00007f301c2eb174
Mar 08 17:04:30 WC filebeat[15509]: 00007f2feeffc990:  00007f2fecffa000  000000000000000d
Mar 08 17:04:30 WC filebeat[15509]: goroutine 1 [runnable]:
Mar 08 17:04:30 WC filebeat[15509]: path/filepath.Abs(0xc000058060, 0x1a, 0x4242e80, 0x7f301c164e98, 0xc000000180, 0xc0000b6480)
Mar 08 17:04:30 WC filebeat[15509]:         /usr/local/go/src/path/filepath/path.go:242 +0x6c
Mar 08 17:04:30 WC filebeat[15509]: github.com/elastic/beats/v7/libbeat/statestore/backend/memlog.New(0xc00088c040, 0xc000058060, 0x1a, 0x180, 0x1000, 0x2aedc50, 0x0, >
Mar 08 17:04:30 WC filebeat[15509]:         /go/src/github.com/elastic/beats/libbeat/statestore/backend/memlog/memlog.go:87 +0x65
Mar 08 17:04:30 WC filebeat[15509]: github.com/elastic/beats/v7/filebeat/beater.openStateStore(0x29fa2ec, 0x8, 0x29fa2ec, 0x8, 0x29f595a, 0x6, 0xc000124fde, 0x2, 0xc00>
Mar 08 17:04:30 WC filebeat[15509]:         /go/src/github.com/elastic/beats/filebeat/beater/store.go:38 +0xd4
Mar 08 17:04:30 WC filebeat[15509]: github.com/elastic/beats/v7/filebeat/beater.(*Filebeat).Run(0xc0008499e0, 0xc0000ce2c0, 0x0, 0x0)
Mar 08 17:04:30 WC filebeat[15509]:         /go/src/github.com/elastic/beats/filebeat/beater/filebeat.go:341 +0x4aa
Mar 08 17:04:30 WC filebeat[15509]: github.com/elastic/beats/v7/libbeat/cmd/instance.(*Beat).launch(0xc0000ce2c0, 0x29fa2ec, 0x8, 0x29fa2ec, 0x8, 0x0, 0x0, 0x1, 0x0, 0>
Mar 08 17:04:30 WC filebeat[15509]:         /go/src/github.com/elastic/beats/libbeat/cmd/instance/beat.go:461 +0x7d8
Mar 08 17:04:30 WC filebeat[15509]: github.com/elastic/beats/v7/libbeat/cmd/instance.Run.func1(0x29fa2ec, 0x8, 0x29fa2ec, 0x8, 0x0, 0x0, 0xc00057dc30, 0xc000012930, 0x>
Mar 08 17:04:30 WC filebeat[15509]:         /go/src/github.com/elastic/beats/libbeat/cmd/instance/beat.go:189 +0x55a
Mar 08 17:04:30 WC filebeat[15509]: github.com/elastic/beats/v7/libbeat/cmd/instance.Run(0x29fa2ec, 0x8, 0x29fa2ec, 0x8, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, ...)
Mar 08 17:04:30 WC filebeat[15509]:         /go/src/github.com/elastic/beats/libbeat/cmd/instance/beat.go:190 +0x148
Mar 08 17:04:30 WC filebeat[15509]: github.com/elastic/beats/v7/libbeat/cmd.genRunCmd.func1(0xc000412b00, 0xc00003afc0, 0x0, 0xc)
Mar 08 17:04:30 WC filebeat[15509]:         /go/src/github.com/elastic/beats/libbeat/cmd/run.go:36 +0x9d
Mar 08 17:04:30 WC filebeat[15509]: github.com/spf13/cobra.(*Command).execute(0xc000412b00, 0xc00004e1b0, 0xc, 0xc, 0xc000412b00, 0xc00004e1b0)
Mar 08 17:04:30 WC filebeat[15509]:         /go/pkg/mod/github.com/spf13/co...@v0.0.5/command.go:830 +0x29d
Mar 08 17:04:30 WC filebeat[15509]: github.com/spf13/cobra.(*Command).ExecuteC(0xc000412b00, 0xc000412b00, 0xffffffff, 0xc0000a2058)
Mar 08 17:04:30 WC filebeat[15509]:         /go/pkg/mod/github.com/spf13/co...@v0.0.5/command.go:914 +0x2fb
Mar 08 17:04:30 WC filebeat[15509]: github.com/spf13/cobra.(*Command).Execute(...)
Mar 08 17:04:30 WC filebeat[15509]:         /go/pkg/mod/github.com/spf13/co...@v0.0.5/command.go:864
Mar 08 17:04:30 WC filebeat[15509]: main.main()
Mar 08 17:04:30 WC filebeat[15509]:         /go/src/github.com/elastic/beats/filebeat/main.go:36 +0x3d
Mar 08 17:04:30 WC filebeat[15509]: goroutine 72 [select]:
Mar 08 17:04:30 WC filebeat[15509]: github.com/elastic/beats/v7/libbeat/publisher/queue/memqueue.(*ackLoop).run(0xc0004d3c70)
Mar 08 17:04:30 WC filebeat[15509]:         /go/src/github.com/elastic/beats/libbeat/publisher/queue/memqueue/ackloop.go:60 +0x107
Mar 08 17:04:30 WC filebeat[15509]: github.com/elastic/beats/v7/libbeat/publisher/queue/memqueue.NewQueue.func2(0xc0001e7810, 0xc0004d3c70)
Mar 08 17:04:30 WC filebeat[15509]:         /go/src/github.com/elastic/beats/libbeat/publisher/queue/memqueue/broker.go:175 +0x59
Mar 08 17:04:30 WC filebeat[15509]: created by github.com/elastic/beats/v7/libbeat/publisher/queue/memqueue.NewQueue
Mar 08 17:04:30 WC filebeat[15509]:         /go/src/github.com/elastic/beats/libbeat/publisher/queue/memqueue/broker.go:173 +0x3a2
Mar 08 17:04:30 WC filebeat[15509]: goroutine 71 [select]:
Mar 08 17:04:30 WC filebeat[15509]: github.com/elastic/beats/v7/libbeat/publisher/queue/memqueue.(*bufferingEventLoop).run(0xc0001aa0a0)
Mar 08 17:04:30 WC filebeat[15509]:         /go/src/github.com/elastic/beats/libbeat/publisher/queue/memqueue/eventloop.go:316 +0x1cf
Mar 08 17:04:30 WC filebeat[15509]: github.com/elastic/beats/v7/libbeat/publisher/queue/memqueue.NewQueue.func1(0xc0001e7810, 0x2d3ed60, 0xc0001aa0a0)
Mar 08 17:04:30 WC filebeat[15509]:         /go/src/github.com/elastic/beats/libbeat/publisher/queue/memqueue/broker.go:171 +0x5f
Mar 08 17:04:30 WC filebeat[15509]: created by github.com/elastic/beats/v7/libbeat/publisher/queue/memqueue.NewQueue
Mar 08 17:04:30 WC filebeat[15509]:         /go/src/github.com/elastic/beats/libbeat/publisher/queue/memqueue/broker.go:169 +0x373
Mar 08 17:04:30 WC filebeat[15509]: goroutine 53 [chan receive]:
Mar 08 17:04:30 WC filebeat[15509]: k8s.io/klog.(*loggingT).flushDaemon(0x4241ce0)
Mar 08 17:04:30 WC filebeat[15509]:         /go/pkg/mod/k8s.io/kl...@v1.0.0/klog.go:1010 +0x8b
Mar 08 17:04:30 WC filebeat[15509]: created by k8s.io/klog.init.0
Mar 08 17:04:30 WC filebeat[15509]:         /go/pkg/mod/k8s.io/kl...@v1.0.0/klog.go:411 +0xd6
Mar 08 17:04:30 WC filebeat[15509]: goroutine 73 [select]:
Mar 08 17:04:30 WC filebeat[15509]: github.com/elastic/beats/v7/libbeat/publisher/queue/memqueue.(*consumer).Get(0xc0001b95e0, 0x32, 0xc0001b95e0, 0x0, 0x0, 0x0)
Mar 08 17:04:30 WC filebeat[15509]:         /go/src/github.com/elastic/beats/libbeat/publisher/queue/memqueue/consume.go:65 +0xe9
Mar 08 17:04:30 WC filebeat[15509]: github.com/elastic/beats/v7/libbeat/publisher/pipeline.(*eventConsumer).loop(0xc000039860, 0x2d3eda0, 0xc0001b95e0)
Mar 08 17:04:30 WC filebeat[15509]:         /go/src/github.com/elastic/beats/libbeat/publisher/pipeline/consumer.go:182 +0x19a
Mar 08 17:04:30 WC filebeat[15509]: github.com/elastic/beats/v7/libbeat/publisher/pipeline.newEventConsumer.func1(0xc000039860, 0x2d3eda0, 0xc0001b95c0)
Mar 08 17:04:30 WC filebeat[15509]:         /go/src/github.com/elastic/beats/libbeat/publisher/pipeline/consumer.go:86 +0x6c
Mar 08 17:04:30 WC filebeat[15509]: created by github.com/elastic/beats/v7/libbeat/publisher/pipeline.newEventConsumer
Mar 08 17:04:30 WC filebeat[15509]:         /go/src/github.com/elastic/beats/libbeat/publisher/pipeline/consumer.go:84 +0x149
Mar 08 17:04:30 WC filebeat[15509]: goroutine 74 [select]:
Mar 08 17:04:30 WC filebeat[15509]: github.com/elastic/beats/v7/libbeat/publisher/pipeline.(*retryer).loop(0xc000039980)
Mar 08 17:04:30 WC filebeat[15509]:         /go/src/github.com/elastic/beats/libbeat/publisher/pipeline/retry.go:135 +0x250
Mar 08 17:04:30 WC filebeat[15509]: created by github.com/elastic/beats/v7/libbeat/publisher/pipeline.newRetryer
Mar 08 17:04:30 WC filebeat[15509]:         /go/src/github.com/elastic/beats/libbeat/publisher/pipeline/retry.go:94 +0x158
Mar 08 17:04:30 WC filebeat[15509]: goroutine 75 [select]:
Mar 08 17:04:30 WC filebeat[15509]: github.com/elastic/beats/v7/libbeat/publisher/pipeline.(*netClientWorker).run(0xc000039b60)
Mar 08 17:04:30 WC filebeat[15509]:         /go/src/github.com/elastic/beats/libbeat/publisher/pipeline/output.go:127 +0xd1
Mar 08 17:04:30 WC filebeat[15509]: created by github.com/elastic/beats/v7/libbeat/publisher/pipeline.makeClientWorker
Mar 08 17:04:30 WC filebeat[15509]:         /go/src/github.com/elastic/beats/libbeat/publisher/pipeline/output.go:79 +0x194
Mar 08 17:04:30 WC filebeat[15509]: goroutine 36 [chan receive]:
Mar 08 17:04:30 WC filebeat[15509]: github.com/elastic/beats/v7/libbeat/service.HandleSignals.func1(0xc00084e360, 0xc0001cebb0, 0xc0001ceba0, 0xc0002c7a60, 0xc0008447e>
Mar 08 17:04:30 WC filebeat[15509]:         /go/src/github.com/elastic/beats/libbeat/service/service.go:50 +0x52
Mar 08 17:04:30 WC filebeat[15509]: created by github.com/elastic/beats/v7/libbeat/service.HandleSignals
Mar 08 17:04:30 WC filebeat[15509]:         /go/src/github.com/elastic/beats/libbeat/service/service.go:49 +0x172
Mar 08 17:04:30 WC filebeat[15509]: goroutine 98 [select]:
Mar 08 17:04:30 WC filebeat[15509]: github.com/elastic/beats/v7/libbeat/monitoring/report/log.(*reporter).snapshotLoop(0xc000849a10)
Mar 08 17:04:30 WC filebeat[15509]:         /go/src/github.com/elastic/beats/libbeat/monitoring/report/log/log.go:129 +0x3cb
Mar 08 17:04:30 WC filebeat[15509]: github.com/elastic/beats/v7/libbeat/monitoring/report/log.MakeReporter.func1(0xc000849a10)
Mar 08 17:04:30 WC filebeat[15509]:         /go/src/github.com/elastic/beats/libbeat/monitoring/report/log/log.go:107 +0x50
Mar 08 17:04:30 WC filebeat[15509]: created by github.com/elastic/beats/v7/libbeat/monitoring/report/log.MakeReporter
Mar 08 17:04:30 WC filebeat[15509]:         /go/src/github.com/elastic/beats/libbeat/monitoring/report/log/log.go:105 +0x157
Mar 08 17:04:30 WC filebeat[15509]: goroutine 99 [syscall]:
Mar 08 17:04:30 WC filebeat[15509]: os/signal.signal_recv(0x0)
Mar 08 17:04:30 WC filebeat[15509]:         /usr/local/go/src/runtime/sigqueue.go:147 +0x9c
Mar 08 17:04:30 WC filebeat[15509]: os/signal.loop()
Mar 08 17:04:30 WC filebeat[15509]:         /usr/local/go/src/os/signal/signal_unix.go:23 +0x22
Mar 08 17:04:30 WC filebeat[15509]: created by os/signal.Notify.func1
Mar 08 17:04:30 WC filebeat[15509]:         /usr/local/go/src/os/signal/signal.go:127 +0x44
Mar 08 17:04:30 WC filebeat[15509]: rax    0x0
Mar 08 17:04:30 WC filebeat[15509]: rbx    0x7f2feeffd640
Mar 08 17:04:30 WC filebeat[15509]: rcx    0x7f301c24d43c
Mar 08 17:04:30 WC filebeat[15509]: rdx    0x6
Mar 08 17:04:30 WC filebeat[15509]: rdi    0x3c95
Mar 08 17:04:30 WC filebeat[15509]: rsi    0x3c9a
Mar 08 17:04:30 WC filebeat[15509]: rbp    0x3c9a
Mar 08 17:04:30 WC filebeat[15509]: rsp    0x7f2feeffc8a0
Mar 08 17:04:30 WC filebeat[15509]: r8     0x7f2feeffc970
Mar 08 17:04:30 WC filebeat[15509]: r9     0x7f301c35d4e0
Mar 08 17:04:30 WC filebeat[15509]: r10    0x8
Mar 08 17:04:30 WC filebeat[15509]: r11    0x246
Mar 08 17:04:30 WC filebeat[15509]: r12    0x6
Mar 08 17:04:30 WC filebeat[15509]: r13    0x16
Mar 08 17:04:30 WC filebeat[15509]: r14    0x7f301c24b3f0
Mar 08 17:04:30 WC filebeat[15509]: r15    0x0
Mar 08 17:04:30 WC filebeat[15509]: rip    0x7f301c24d43c
Mar 08 17:04:30 WC filebeat[15509]: rflags 0x246
Mar 08 17:04:30 WC filebeat[15509]: cs     0x33
Mar 08 17:04:30 WC filebeat[15509]: fs     0x0
Mar 08 17:04:30 WC filebeat[15509]: gs     0x0
Mar 08 17:04:30 WC systemd[1]: filebeat.service: Main process exited, code=exited, status=2/INVALIDARGUMENT
░░ Subject: Unit process exited
░░ Defined-By: systemd
░░ Support: https://access.redhat.com/support
░░
░░ An ExecStart= process belonging to unit filebeat.service has exited.
░░
░░ The process' exit code is 'exited' and its exit status is 2.
Mar 08 17:04:30 WC systemd[1]: filebeat.service: Failed with result 'exit-code'.
░░ Subject: Unit failed
░░ Defined-By: systemd
░░ Support: https://access.redhat.com/support
░░
░░ The unit filebeat.service has entered the 'failed' state with result 'exit-code'.
Mar 08 17:04:30 WC systemd[1]: filebeat.service: Scheduled restart job, restart counter is at 3.
░░ Subject: Automatic restarting of a unit has been scheduled
░░ Defined-By: systemd
░░ Support: https://access.redhat.com/support
░░
░░ Automatic restarting of the unit filebeat.service has been scheduled, as the result for
░░ the configured Restart= setting for the unit.
Mar 08 17:04:30 WC systemd[1]: Stopped Filebeat sends log files to Logstash or directly to Elasticsearch..
░░ Subject: A stop job for unit filebeat.service has finished
░░ Defined-By: systemd
░░ Support: https://access.redhat.com/support
░░
░░ A stop job for unit filebeat.service has finished.
░░
░░ The job identifier is 12173 and the job result is done.
Mar 08 17:04:30 WC systemd[1]: Started Filebeat sends log files to Logstash or directly to Elasticsearch..
░░ Subject: A start job for unit filebeat.service has finished successfully
░░ Defined-By: systemd
░░ Support: https://access.redhat.com/support
░░
░░ A start job for unit filebeat.service has finished successfully.
░░
░░ The job identifier is 12173.
Mar 08 17:04:30 WC filebeat[15517]: 2022-03-08T17:04:30.348+0530        INFO        instance/beat.go:645        Home path: [/usr/share/filebeat] Config path: [/etc/fil>
Mar 08 17:04:30 WC filebeat[15517]: 2022-03-08T17:04:30.348+0530        INFO        instance/beat.go:653        Beat ID: 3d0668f2-7e97-49bf-80b0-dedb88a541e4
Mar 08 17:04:30 WC filebeat[15517]: 2022-03-08T17:04:30.349+0530        INFO        [seccomp]        seccomp/seccomp.go:124        Syscall filter successfully installed
Mar 08 17:04:30 WC filebeat[15517]: 2022-03-08T17:04:30.349+0530        INFO        [beat]        instance/beat.go:981        Beat info        {"system_info": {"beat":>
Mar 08 17:04:30 WC filebeat[15517]: 2022-03-08T17:04:30.349+0530        INFO        [beat]        instance/beat.go:990        Build info        {"system_info": {"build>
Mar 08 17:04:30 WC filebeat[15517]: 2022-03-08T17:04:30.349+0530        INFO        [beat]        instance/beat.go:993        Go runtime info        {"system_info": {">
Mar 08 17:04:30 WC filebeat[15517]: 2022-03-08T17:04:30.349+0530        INFO        [beat]        instance/beat.go:997        Host info        {"system_info": {"host":>
Mar 08 17:04:30 WC filebeat[15517]: 2022-03-08T17:04:30.350+0530        INFO        [beat]        instance/beat.go:1026        Process info        {"system_info": {"pr>
Mar 08 17:04:30 WC filebeat[15517]: 2022-03-08T17:04:30.350+0530        INFO        instance/beat.go:299        Setup Beat: filebeat; Version: 7.10.2
Mar 08 17:04:30 WC filebeat[15517]: 2022-03-08T17:04:30.350+0530        INFO        eslegclient/connection.go:99        elasticsearch url: https://127.0.0.1:9200
Mar 08 17:04:30 WC filebeat[15517]: 2022-03-08T17:04:30.350+0530        INFO        [publisher]        pipeline/module.go:113        Beat name: WC
Mar 08 17:04:30 WC filebeat[15517]: 2022-03-08T17:04:30.352+0530        INFO        beater/filebeat.go:117        Enabled modules/filesets:  (), wazuh (alerts)
Mar 08 17:04:30 WC filebeat[15517]: 2022-03-08T17:04:30.352+0530        INFO        [monitoring]        log/log.go:118        Starting metrics logging every 30s
Mar 08 17:04:30 WC filebeat[15517]: runtime/cgo: pthread_create failed: Operation not permitted
Mar 08 17:04:30 WC filebeat[15517]: SIGABRT: abort
Mar 08 17:04:30 WC filebeat[15517]: PC=0x7f9f40f0e43c m=3 sigcode=18446744073709551610
Mar 08 17:04:30 WC filebeat[15517]: goroutine 0 [idle]:
Mar 08 17:04:30 WC filebeat[15517]: runtime: unknown pc 0x7f9f40f0e43c
Mar 08 17:04:30 WC filebeat[15517]: stack: frame={sp:0x7f9f13ffe7b0, fp:0x0} stack=[0x7f9f137ff1e8,0x7f9f13ffede8)
Mar 08 17:04:30 WC filebeat[15517]: 00007f9f13ffe6b0:  0000000000dbf9f5  0000000000dbf9f5
Mar 08 17:04:30 WC filebeat[15517]: 00007f9f13ffe6c0:  0000000000000000  0000000000000000
Mar 08 17:04:30 WC filebeat[15517]: 00007f9f13ffe6d0:  0000000004014f40  0000000003002878
Mar 08 17:04:30 WC filebeat[15517]: 00007f9f13ffe6e0:  00007f9f13ffe7b0  0000000000f192d4 <runtime.adjustframe+132>
Mar 08 17:04:30 WC filebeat[15517]: 00007f9f13ffe6f0:  00007f9f13ffea30  00007f9f13ffeb38
Mar 08 17:04:30 WC filebeat[15517]: 00007f9f13ffe700:  0000000000f32a01 <runtime.memhash32+49>  0000000000000000
Mar 08 17:04:30 WC filebeat[15517]: 00007f9f13ffe710:  0000000000000000  0000000000000000
Mar 08 17:04:30 WC filebeat[15517]: 00007f9f13ffe720:  0000000000000000  0000000000000000
Mar 08 17:04:30 WC filebeat[15517]: 00007f9f13ffe730:  0000000000000000  0000000000000000
Mar 08 17:04:30 WC filebeat[15517]: 00007f9f13ffe740:  00007f9f13ffe7b0  0000000000000000
Mar 08 17:04:30 WC filebeat[15517]: 00007f9f13ffe750:  0000000003002878  0000000004014f40
Mar 08 17:04:30 WC filebeat[15517]: 00007f9f13ffe760:  000000000013376f  0000000000000000
Mar 08 17:04:30 WC filebeat[15517]: 00007f9f13ffe770:  00007f9f13ffe8a0  0000000002daa901
Mar 08 17:04:30 WC filebeat[15517]: 00007f9f13ffe780:  0000000003002878  0000000004014f40
Mar 08 17:04:30 WC filebeat[15517]: 00007f9f13ffe790:  0000000000000000  00007f9f40f1ba49
Mar 08 17:04:30 WC filebeat[15517]: 00007f9f13ffe7a0:  0000000000000000  00007f9f40f0e42e
Mar 08 17:04:30 WC filebeat[15517]: 00007f9f13ffe7b0: <0000000000000130  0000000000f269ee <runtime.gentraceback+4366>
Mar 08 17:04:30 WC filebeat[15517]: 00007f9f13ffe7c0:  0000000000000120  00007f9f13ffeb20
Mar 08 17:04:30 WC filebeat[15517]: 00007f9f13ffe7d0:  0000000000000013  00007f9f13ffe8a0
Mar 08 17:04:30 WC filebeat[15517]: 00007f9f13ffe7e0:  0000000000000000  0000000000000004
Mar 08 17:04:30 WC filebeat[15517]: 00007f9f13ffe7f0:  0000003400000013  00007f9f40fbc6d1
Mar 08 17:04:30 WC filebeat[15517]: 00007f9f13ffe800:  00007f9f1273c640  00007f9f13ffeac0
Mar 08 17:04:30 WC filebeat[15517]: 00007f9f13ffe810:  00007f9f13ffe93e  00007f9f13ffe93f
Mar 08 17:04:30 WC filebeat[15517]: 00007f9f13ffe820:  00007f9f1273c640  00007f9f40f0c2f5
Mar 08 17:04:30 WC filebeat[15517]: 00007f9f13ffe830:  00007f9f0c000020  12eb5e7352e82f00
Mar 08 17:04:30 WC filebeat[15517]: 00007f9f13ffe840:  00007f9f13fff640  0000000000000006
Mar 08 17:04:30 WC filebeat[15517]: 00007f9f13ffe850:  00007f9f0c000c90  0000000000000000
Mar 08 17:04:30 WC filebeat[15517]: 00007f9f13ffe860:  0000000002cf0118  00007f9f40ec1d06
Mar 08 17:04:30 WC filebeat[15517]: 00007f9f13ffe870:  00007f9f41064990  00007f9f40e947d3
Mar 08 17:04:30 WC filebeat[15517]: 00007f9f13ffe880:  0000000000000020  0000000000000000
Mar 08 17:04:30 WC filebeat[15517]: 00007f9f13ffe890:  0000000000000000  00007f9f40fac174
Mar 08 17:04:30 WC filebeat[15517]: 00007f9f13ffe8a0:  00007f9f11f3c000  000000000000000d
Mar 08 17:04:30 WC filebeat[15517]: runtime: unknown pc 0x7f9f40f0e43c
Mar 08 17:04:30 WC filebeat[15517]: stack: frame={sp:0x7f9f13ffe7b0, fp:0x0} stack=[0x7f9f137ff1e8,0x7f9f13ffede8)
Mar 08 17:04:30 WC filebeat[15517]: 00007f9f13ffe6b0:  0000000000dbf9f5  0000000000dbf9f5
Mar 08 17:04:30 WC filebeat[15517]: 00007f9f13ffe6c0:  0000000000000000  0000000000000000
Mar 08 17:04:30 WC filebeat[15517]: 00007f9f13ffe6d0:  0000000004014f40  0000000003002878
Mar 08 17:04:30 WC filebeat[15517]: 00007f9f13ffe6e0:  00007f9f13ffe7b0  0000000000f192d4 <runtime.adjustframe+132>
Mar 08 17:04:30 WC filebeat[15517]: 00007f9f13ffe6f0:  00007f9f13ffea30  00007f9f13ffeb38
Mar 08 17:04:30 WC filebeat[15517]: 00007f9f13ffe700:  0000000000f32a01 <runtime.memhash32+49>  0000000000000000
Mar 08 17:04:30 WC filebeat[15517]: 00007f9f13ffe710:  0000000000000000  0000000000000000
Mar 08 17:04:30 WC filebeat[15517]: 00007f9f13ffe720:  0000000000000000  0000000000000000
Mar 08 17:04:30 WC filebeat[15517]: 00007f9f13ffe730:  0000000000000000  0000000000000000
Mar 08 17:04:30 WC filebeat[15517]: 00007f9f13ffe740:  00007f9f13ffe7b0  0000000000000000
Mar 08 17:04:30 WC filebeat[15517]: 00007f9f13ffe750:  0000000003002878  0000000004014f40
Mar 08 17:04:30 WC filebeat[15517]: 00007f9f13ffe760:  000000000013376f  0000000000000000
Mar 08 17:04:30 WC filebeat[15517]: 00007f9f13ffe770:  00007f9f13ffe8a0  0000000002daa901
Mar 08 17:04:30 WC filebeat[15517]: 00007f9f13ffe780:  0000000003002878  0000000004014f40
Mar 08 17:04:30 WC filebeat[15517]: 00007f9f13ffe790:  0000000000000000  00007f9f40f1ba49
Mar 08 17:04:30 WC filebeat[15517]: 00007f9f13ffe7a0:  0000000000000000  00007f9f40f0e42e
Mar 08 17:04:30 WC filebeat[15517]: 00007f9f13ffe7b0: <0000000000000130  0000000000f269ee <runtime.gentraceback+4366>
Mar 08 17:04:30 WC filebeat[15517]: 00007f9f13ffe7c0:  0000000000000120  00007f9f13ffeb20
Mar 08 17:04:30 WC filebeat[15517]: 00007f9f13ffe7d0:  0000000000000013  00007f9f13ffe8a0
Mar 08 17:04:30 WC filebeat[15517]: 00007f9f13ffe7e0:  0000000000000000  0000000000000004
Mar 08 17:04:30 WC filebeat[15517]: 00007f9f13ffe7f0:  0000003400000013  00007f9f40fbc6d1
Mar 08 17:04:30 WC filebeat[15517]: 00007f9f13ffe800:  00007f9f1273c640  00007f9f13ffeac0
Mar 08 17:04:30 WC filebeat[15517]: 00007f9f13ffe810:  00007f9f13ffe93e  00007f9f13ffe93f
Mar 08 17:04:30 WC filebeat[15517]: 00007f9f13ffe820:  00007f9f1273c640  00007f9f40f0c2f5
Mar 08 17:04:30 WC filebeat[15517]: 00007f9f13ffe830:  00007f9f0c000020  12eb5e7352e82f00
Mar 08 17:04:30 WC filebeat[15517]: 00007f9f13ffe840:  00007f9f13fff640  0000000000000006
Mar 08 17:04:30 WC filebeat[15517]: 00007f9f13ffe850:  00007f9f0c000c90  0000000000000000
Mar 08 17:04:30 WC filebeat[15517]: 00007f9f13ffe860:  0000000002cf0118  00007f9f40ec1d06
Mar 08 17:04:30 WC filebeat[15517]: 00007f9f13ffe870:  00007f9f41064990  00007f9f40e947d3
Mar 08 17:04:30 WC filebeat[15517]: 00007f9f13ffe880:  0000000000000020  0000000000000000
Mar 08 17:04:30 WC filebeat[15517]: 00007f9f13ffe890:  0000000000000000  00007f9f40fac174
Mar 08 17:04:30 WC filebeat[15517]: 00007f9f13ffe8a0:  00007f9f11f3c000  000000000000000d
Mar 08 17:04:30 WC filebeat[15517]: goroutine 1 [runnable]:
Mar 08 17:04:30 WC filebeat[15517]: os/signal.signal_enable(0x469fa69f0000000f)
Mar 08 17:04:30 WC filebeat[15517]:         /usr/local/go/src/runtime/sigqueue.go:219 +0x6c
Mar 08 17:04:30 WC filebeat[15517]: os/signal.enableSignal(...)
Mar 08 17:04:30 WC filebeat[15517]:         /usr/local/go/src/os/signal/signal_unix.go:51
Mar 08 17:04:30 WC filebeat[15517]: os/signal.Notify.func2(0xf)
Mar 08 17:04:30 WC filebeat[15517]:         /usr/local/go/src/os/signal/signal.go:150 +0x8e
Mar 08 17:04:30 WC filebeat[15517]: os/signal.Notify(0xc0000e51a0, 0xc0004ff3b8, 0x3, 0x3)
Mar 08 17:04:30 WC filebeat[15517]:         /usr/local/go/src/os/signal/signal.go:162 +0x170
Mar 08 17:04:30 WC filebeat[15517]: github.com/elastic/beats/v7/libbeat/service.HandleSignals(0xc0004e6ae0, 0xc0007caed0)
Mar 08 17:04:30 WC filebeat[15517]:         /go/src/github.com/elastic/beats/libbeat/service/service.go:48 +0x122
Mar 08 17:04:30 WC filebeat[15517]: github.com/elastic/beats/v7/libbeat/cmd/instance.(*Beat).launch(0xc0001522c0, 0x29fa2ec, 0x8, 0x29fa2ec, 0x8, 0x0, 0x0, 0x1, 0x0, 0>
Mar 08 17:04:30 WC filebeat[15517]:         /go/src/github.com/elastic/beats/libbeat/cmd/instance/beat.go:448 +0x633
Mar 08 17:04:30 WC filebeat[15517]: github.com/elastic/beats/v7/libbeat/cmd/instance.Run.func1(0x29fa2ec, 0x8, 0x29fa2ec, 0x8, 0x0, 0x0, 0xc0005d1c30, 0xc0004d5cd0, 0x>
Mar 08 17:04:30 WC filebeat[15517]:         /go/src/github.com/elastic/beats/libbeat/cmd/instance/beat.go:189 +0x55a
Mar 08 17:04:30 WC filebeat[15517]: github.com/elastic/beats/v7/libbeat/cmd/instance.Run(0x29fa2ec, 0x8, 0x29fa2ec, 0x8, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, ...)
Mar 08 17:04:30 WC filebeat[15517]:         /go/src/github.com/elastic/beats/libbeat/cmd/instance/beat.go:190 +0x148
Mar 08 17:04:30 WC filebeat[15517]: github.com/elastic/beats/v7/libbeat/cmd.genRunCmd.func1(0xc0005b0dc0, 0xc000024fc0, 0x0, 0xc)
Mar 08 17:04:30 WC filebeat[15517]:         /go/src/github.com/elastic/beats/libbeat/cmd/run.go:36 +0x9d
Mar 08 17:04:30 WC filebeat[15517]: github.com/spf13/cobra.(*Command).execute(0xc0005b0dc0, 0xc0001260e0, 0xc, 0xc, 0xc0005b0dc0, 0xc0001260e0)
Mar 08 17:04:30 WC filebeat[15517]:         /go/pkg/mod/github.com/spf13/co...@v0.0.5/command.go:830 +0x29d
Mar 08 17:04:30 WC filebeat[15517]: github.com/spf13/cobra.(*Command).ExecuteC(0xc0005b0dc0, 0xc0005b0dc0, 0xffffffff, 0xc000116058)
Mar 08 17:04:30 WC filebeat[15517]:         /go/pkg/mod/github.com/spf13/co...@v0.0.5/command.go:914 +0x2fb
Mar 08 17:04:30 WC filebeat[15517]: github.com/spf13/cobra.(*Command).Execute(...)
Mar 08 17:04:30 WC filebeat[15517]:         /go/pkg/mod/github.com/spf13/co...@v0.0.5/command.go:864
Mar 08 17:04:30 WC filebeat[15517]: main.main()
Mar 08 17:04:30 WC filebeat[15517]:         /go/src/github.com/elastic/beats/filebeat/main.go:36 +0x3d
Mar 08 17:04:30 WC filebeat[15517]: goroutine 5 [chan receive]:
Mar 08 17:04:30 WC filebeat[15517]: k8s.io/klog.(*loggingT).flushDaemon(0x4241ce0)
Mar 08 17:04:30 WC filebeat[15517]:         /go/pkg/mod/k8s.io/kl...@v1.0.0/klog.go:1010 +0x8b
Mar 08 17:04:30 WC filebeat[15517]: created by k8s.io/klog.init.0
Mar 08 17:04:30 WC filebeat[15517]:         /go/pkg/mod/k8s.io/kl...@v1.0.0/klog.go:411 +0xd6
Mar 08 17:04:30 WC filebeat[15517]: goroutine 71 [select]:
Mar 08 17:04:30 WC filebeat[15517]: github.com/elastic/beats/v7/libbeat/publisher/queue/memqueue.(*bufferingEventLoop).run(0xc0000eed20)
Mar 08 17:04:30 WC filebeat[15517]:         /go/src/github.com/elastic/beats/libbeat/publisher/queue/memqueue/eventloop.go:316 +0x1cf
Mar 08 17:04:30 WC filebeat[15517]: github.com/elastic/beats/v7/libbeat/publisher/queue/memqueue.NewQueue.func1(0xc0001c5c00, 0x2d3ed60, 0xc0000eed20)
Mar 08 17:04:30 WC filebeat[15517]:         /go/src/github.com/elastic/beats/libbeat/publisher/queue/memqueue/broker.go:171 +0x5f
Mar 08 17:04:30 WC filebeat[15517]: created by github.com/elastic/beats/v7/libbeat/publisher/queue/memqueue.NewQueue
Mar 08 17:04:30 WC filebeat[15517]:         /go/src/github.com/elastic/beats/libbeat/publisher/queue/memqueue/broker.go:169 +0x373
Mar 08 17:04:30 WC filebeat[15517]: goroutine 72 [select]:
Mar 08 17:04:30 WC filebeat[15517]: github.com/elastic/beats/v7/libbeat/publisher/queue/memqueue.(*ackLoop).run(0xc0004d7720)
Mar 08 17:04:30 WC filebeat[15517]:         /go/src/github.com/elastic/beats/libbeat/publisher/queue/memqueue/ackloop.go:60 +0x107
Mar 08 17:04:30 WC filebeat[15517]: github.com/elastic/beats/v7/libbeat/publisher/queue/memqueue.NewQueue.func2(0xc0001c5c00, 0xc0004d7720)
Mar 08 17:04:30 WC filebeat[15517]:         /go/src/github.com/elastic/beats/libbeat/publisher/queue/memqueue/broker.go:175 +0x59
Mar 08 17:04:30 WC filebeat[15517]: created by github.com/elastic/beats/v7/libbeat/publisher/queue/memqueue.NewQueue
Mar 08 17:04:30 WC filebeat[15517]:         /go/src/github.com/elastic/beats/libbeat/publisher/queue/memqueue/broker.go:173 +0x3a2
Mar 08 17:04:30 WC filebeat[15517]: goroutine 73 [select]:
Mar 08 17:04:30 WC filebeat[15517]: github.com/elastic/beats/v7/libbeat/publisher/queue/memqueue.(*consumer).Get(0xc00013b020, 0x32, 0x0, 0x0, 0x0, 0x0)
Mar 08 17:04:30 WC filebeat[15517]:         /go/src/github.com/elastic/beats/libbeat/publisher/queue/memqueue/consume.go:65 +0xe9
Mar 08 17:04:30 WC filebeat[15517]: github.com/elastic/beats/v7/libbeat/publisher/pipeline.(*eventConsumer).loop(0xc000020a20, 0x2d3eda0, 0xc00013b020)
Mar 08 17:04:30 WC filebeat[15517]:         /go/src/github.com/elastic/beats/libbeat/publisher/pipeline/consumer.go:182 +0x19a
Mar 08 17:04:30 WC filebeat[15517]: github.com/elastic/beats/v7/libbeat/publisher/pipeline.newEventConsumer.func1(0xc000020a20, 0x2d3eda0, 0xc00013afc0)
Mar 08 17:04:30 WC filebeat[15517]:         /go/src/github.com/elastic/beats/libbeat/publisher/pipeline/consumer.go:86 +0x6c
Mar 08 17:04:30 WC filebeat[15517]: created by github.com/elastic/beats/v7/libbeat/publisher/pipeline.newEventConsumer
Mar 08 17:04:30 WC filebeat[15517]:         /go/src/github.com/elastic/beats/libbeat/publisher/pipeline/consumer.go:84 +0x149
Mar 08 17:04:30 WC filebeat[15517]: goroutine 74 [select]:
Mar 08 17:04:30 WC filebeat[15517]: github.com/elastic/beats/v7/libbeat/publisher/pipeline.(*retryer).loop(0xc000020b40)
Mar 08 17:04:30 WC filebeat[15517]:         /go/src/github.com/elastic/beats/libbeat/publisher/pipeline/retry.go:135 +0x250
Mar 08 17:04:30 WC filebeat[15517]: created by github.com/elastic/beats/v7/libbeat/publisher/pipeline.newRetryer
Mar 08 17:04:30 WC filebeat[15517]:         /go/src/github.com/elastic/beats/libbeat/publisher/pipeline/retry.go:94 +0x158
Mar 08 17:04:30 WC filebeat[15517]: goroutine 75 [select]:
Mar 08 17:04:30 WC filebeat[15517]: github.com/elastic/beats/v7/libbeat/publisher/pipeline.(*netClientWorker).run(0xc000020d20)
Mar 08 17:04:30 WC filebeat[15517]:         /go/src/github.com/elastic/beats/libbeat/publisher/pipeline/output.go:127 +0xd1
Mar 08 17:04:30 WC filebeat[15517]: created by github.com/elastic/beats/v7/libbeat/publisher/pipeline.makeClientWorker
Mar 08 17:04:30 WC filebeat[15517]:         /go/src/github.com/elastic/beats/libbeat/publisher/pipeline/output.go:79 +0x194
Mar 08 17:04:30 WC filebeat[15517]: goroutine 98 [select]:
Mar 08 17:04:30 WC filebeat[15517]: github.com/elastic/beats/v7/libbeat/monitoring/report/log.(*reporter).snapshotLoop(0xc00031ecf0)
Mar 08 17:04:30 WC filebeat[15517]:         /go/src/github.com/elastic/beats/libbeat/monitoring/report/log/log.go:129 +0x3cb
Mar 08 17:04:30 WC filebeat[15517]: github.com/elastic/beats/v7/libbeat/monitoring/report/log.MakeReporter.func1(0xc00031ecf0)
Mar 08 17:04:30 WC filebeat[15517]:         /go/src/github.com/elastic/beats/libbeat/monitoring/report/log/log.go:107 +0x50
Mar 08 17:04:30 WC filebeat[15517]: created by github.com/elastic/beats/v7/libbeat/monitoring/report/log.MakeReporter
Mar 08 17:04:30 WC filebeat[15517]:         /go/src/github.com/elastic/beats/libbeat/monitoring/report/log/log.go:105 +0x157
Mar 08 17:04:30 WC filebeat[15517]: goroutine 99 [syscall]:
Mar 08 17:04:30 WC filebeat[15517]: os/signal.signal_recv(0xf32ac1)
Mar 08 17:04:30 WC filebeat[15517]:         /usr/local/go/src/runtime/sigqueue.go:147 +0x9c
Mar 08 17:04:30 WC filebeat[15517]: os/signal.loop()
Mar 08 17:04:30 WC filebeat[15517]:         /usr/local/go/src/os/signal/signal_unix.go:23 +0x22
Mar 08 17:04:30 WC filebeat[15517]: created by os/signal.Notify.func1
Mar 08 17:04:30 WC filebeat[15517]:         /usr/local/go/src/os/signal/signal.go:127 +0x44
Mar 08 17:04:30 WC filebeat[15517]: rax    0x0
Mar 08 17:04:30 WC filebeat[15517]: rbx    0x7f9f13fff640
Mar 08 17:04:30 WC filebeat[15517]: rcx    0x7f9f40f0e43c
Mar 08 17:04:30 WC filebeat[15517]: rdx    0x6
Mar 08 17:04:30 WC filebeat[15517]: rdi    0x3c9d
Mar 08 17:04:30 WC filebeat[15517]: rsi    0x3c9f
Mar 08 17:04:30 WC filebeat[15517]: rbp    0x3c9f
Mar 08 17:04:30 WC filebeat[15517]: rsp    0x7f9f13ffe7b0
Mar 08 17:04:30 WC filebeat[15517]: r8     0x7f9f13ffe880
Mar 08 17:04:30 WC filebeat[15517]: r9     0x7f9f4101e4e0
Mar 08 17:04:30 WC filebeat[15517]: r10    0x8
Mar 08 17:04:30 WC filebeat[15517]: r11    0x246
Mar 08 17:04:30 WC filebeat[15517]: r12    0x6
Mar 08 17:04:30 WC filebeat[15517]: r13    0x0
Mar 08 17:04:30 WC filebeat[15517]: r14    0x2cf0118
Mar 08 17:04:30 WC filebeat[15517]: r15    0x0
Mar 08 17:04:30 WC filebeat[15517]: rip    0x7f9f40f0e43c
Mar 08 17:04:30 WC filebeat[15517]: rflags 0x246
Mar 08 17:04:30 WC filebeat[15517]: cs     0x33
Mar 08 17:04:30 WC filebeat[15517]: fs     0x0
Mar 08 17:04:30 WC filebeat[15517]: gs     0x0
Mar 08 17:04:30 WC systemd[1]: filebeat.service: Main process exited, code=exited, status=2/INVALIDARGUMENT
░░ Subject: Unit process exited
░░ Defined-By: systemd
░░ Support: https://access.redhat.com/support
░░
░░ An ExecStart= process belonging to unit filebeat.service has exited.
░░
░░ The process' exit code is 'exited' and its exit status is 2.
Mar 08 17:04:30 WC systemd[1]: filebeat.service: Failed with result 'exit-code'.
░░ Subject: Unit failed
░░ Defined-By: systemd
░░ Support: https://access.redhat.com/support
░░
░░ The unit filebeat.service has entered the 'failed' state with result 'exit-code'.
Mar 08 17:04:30 WC systemd[1]: filebeat.service: Scheduled restart job, restart counter is at 4.
░░ Subject: Automatic restarting of a unit has been scheduled
░░ Defined-By: systemd
░░ Support: https://access.redhat.com/support
░░
░░ Automatic restarting of the unit filebeat.service has been scheduled, as the result for
░░ the configured Restart= setting for the unit.
Mar 08 17:04:30 WC systemd[1]: Stopped Filebeat sends log files to Logstash or directly to Elasticsearch..
░░ Subject: A stop job for unit filebeat.service has finished
░░ Defined-By: systemd
░░ Support: https://access.redhat.com/support
░░
░░ A stop job for unit filebeat.service has finished.
░░
░░ The job identifier is 12284 and the job result is done.
Mar 08 17:04:30 WC systemd[1]: Started Filebeat sends log files to Logstash or directly to Elasticsearch..
░░ Subject: A start job for unit filebeat.service has finished successfully
░░ Defined-By: systemd
░░ Support: https://access.redhat.com/support
░░
░░ A start job for unit filebeat.service has finished successfully.
░░
░░ The job identifier is 12284.
Mar 08 17:04:30 WC filebeat[15525]: 2022-03-08T17:04:30.602+0530        INFO        instance/beat.go:645        Home path: [/usr/share/filebeat] Config path: [/etc/fil>
Mar 08 17:04:30 WC filebeat[15525]: 2022-03-08T17:04:30.603+0530        INFO        instance/beat.go:653        Beat ID: 3d0668f2-7e97-49bf-80b0-dedb88a541e4
Mar 08 17:04:30 WC filebeat[15525]: 2022-03-08T17:04:30.603+0530        INFO        [seccomp]        seccomp/seccomp.go:124        Syscall filter successfully installed
Mar 08 17:04:30 WC filebeat[15525]: 2022-03-08T17:04:30.603+0530        INFO        [beat]        instance/beat.go:981        Beat info        {"system_info": {"beat":>
Mar 08 17:04:30 WC filebeat[15525]: 2022-03-08T17:04:30.603+0530        INFO        [beat]        instance/beat.go:990        Build info        {"system_info": {"build>
Mar 08 17:04:30 WC filebeat[15525]: 2022-03-08T17:04:30.603+0530        INFO        [beat]        instance/beat.go:993        Go runtime info        {"system_info": {">
Mar 08 17:04:30 WC filebeat[15525]: 2022-03-08T17:04:30.604+0530        INFO        [beat]        instance/beat.go:997        Host info        {"system_info": {"host":>
Mar 08 17:04:30 WC filebeat[15525]: 2022-03-08T17:04:30.610+0530        INFO        [beat]        instance/beat.go:1026        Process info        {"system_info": {"pr>
Mar 08 17:04:30 WC filebeat[15525]: 2022-03-08T17:04:30.610+0530        INFO        instance/beat.go:299        Setup Beat: filebeat; Version: 7.10.2
Mar 08 17:04:30 WC filebeat[15525]: 2022-03-08T17:04:30.611+0530        INFO        eslegclient/connection.go:99        elasticsearch url: https://127.0.0.1:9200
Mar 08 17:04:30 WC filebeat[15525]: 2022-03-08T17:04:30.612+0530        INFO        [publisher]        pipeline/module.go:113        Beat name: WC
Mar 08 17:04:30 WC filebeat[15525]: 2022-03-08T17:04:30.612+0530        INFO        beater/filebeat.go:117        Enabled modules/filesets:  (), wazuh (alerts)
Mar 08 17:04:30 WC filebeat[15525]: 2022-03-08T17:04:30.613+0530        INFO        [monitoring]        log/log.go:118        Starting metrics logging every 30s
Mar 08 17:04:30 WC filebeat[15525]: runtime/cgo: pthread_create failed: Operation not permitted
Mar 08 17:04:30 WC filebeat[15525]: SIGABRT: abort
Mar 08 17:04:30 WC filebeat[15525]: PC=0x7fe62954743c m=0 sigcode=18446744073709551610
Mar 08 17:04:30 WC filebeat[15525]: goroutine 0 [idle]:
Mar 08 17:04:30 WC filebeat[15525]: runtime: unknown pc 0x7fe62954743c
Mar 08 17:04:30 WC filebeat[15525]: stack: frame={sp:0x7fffd9e39940, fp:0x0} stack=[0x7fffd963af68,0x7fffd9e39fa0)
Mar 08 17:04:30 WC filebeat[15525]: 00007fffd9e39840:  00000000030028af  0000000000dbf9f5
Mar 08 17:04:30 WC filebeat[15525]: 00007fffd9e39850:  0000000000dbf9f5  0000000000000000
Mar 08 17:04:30 WC filebeat[15525]: 00007fffd9e39860:  0000000000000000  0000000004014f40
Mar 08 17:04:30 WC filebeat[15525]: 00007fffd9e39870:  0000000003002878  00007fffd9e39948
Mar 08 17:04:30 WC filebeat[15525]: 00007fffd9e39880:  0000000000f192d4 <runtime.adjustframe+132>  0000000000efb062 <runtime.netpoll+146>
Mar 08 17:04:30 WC filebeat[15525]: 00007fffd9e39890:  0000000000efb062 <runtime.netpoll+146>  00007fff00000003
Mar 08 17:04:30 WC filebeat[15525]: 00007fffd9e398a0:  00007fffd9e398e0  0000000000000080
Mar 08 17:04:30 WC filebeat[15525]: 00007fffd9e398b0:  0000000000000000  0000000000000000
Mar 08 17:04:30 WC filebeat[15525]: 00007fffd9e398c0:  0000000000000000  0000000000000000
Mar 08 17:04:30 WC filebeat[15525]: 00007fffd9e398d0:  0000000000000000  0000000000000000
Mar 08 17:04:30 WC filebeat[15525]: 00007fffd9e398e0:  0000000000000000  0000000000000000
Mar 08 17:04:30 WC filebeat[15525]: 00007fffd9e398f0:  0000000000000000  0000000000000000
Mar 08 17:04:30 WC filebeat[15525]: 00007fffd9e39900:  0000000000000000  0000000000000000
Mar 08 17:04:30 WC filebeat[15525]: 00007fffd9e39910:  0000000000000000  0000000000000000
Mar 08 17:04:30 WC filebeat[15525]: 00007fffd9e39920:  0000000000000000  00007fe62955465c
Mar 08 17:04:30 WC filebeat[15525]: 00007fffd9e39930:  0000000000000000  00007fe62954742e
Mar 08 17:04:30 WC filebeat[15525]: 00007fffd9e39940: <0000000000000130  0000000000000007
Mar 08 17:04:30 WC filebeat[15525]: 00007fffd9e39950:  0000000000000120  142ce523a073e245
Mar 08 17:04:30 WC filebeat[15525]: 00007fffd9e39960:  0000000000000013  0000000000000021
Mar 08 17:04:30 WC filebeat[15525]: 00007fffd9e39970:  0000000000000150  0000000000000004
Mar 08 17:04:30 WC filebeat[15525]: 00007fffd9e39980:  0000003400000013  00007fe6295f56d1
Mar 08 17:04:30 WC filebeat[15525]: 00007fffd9e39990:  00007fe5f2ffd640  00007fffd9e39c50
Mar 08 17:04:30 WC filebeat[15525]: 00007fffd9e399a0:  00007fffd9e39ace  00007fffd9e39acf
Mar 08 17:04:30 WC filebeat[15525]: 00007fffd9e399b0:  00007fe5f2ffd640  00007fe6295452f5
Mar 08 17:04:30 WC filebeat[15525]: 00007fffd9e399c0:  00007fe62969baa0  dee5fc6fdec4ba00
Mar 08 17:04:30 WC filebeat[15525]: 00007fffd9e399d0:  00007fe62949e740  0000000000000006
Mar 08 17:04:30 WC filebeat[15525]: 00007fffd9e399e0:  0000000004410f70  0000000000000000
Mar 08 17:04:30 WC filebeat[15525]: 00007fffd9e399f0:  0000000002cf0118  00007fe6294fad06
Mar 08 17:04:30 WC filebeat[15525]: 00007fffd9e39a00:  00007fe62969d990  00007fe6294cd7d3
Mar 08 17:04:30 WC filebeat[15525]: 00007fffd9e39a10:  0000000000000020  0000000000000000
Mar 08 17:04:30 WC filebeat[15525]: 00007fffd9e39a20:  0000000000000000  00007fe6295e5174
Mar 08 17:04:30 WC filebeat[15525]: 00007fffd9e39a30:  00007fe5f27fd000  000000000000000d
Mar 08 17:04:30 WC filebeat[15525]: runtime: unknown pc 0x7fe62954743c
Mar 08 17:04:30 WC filebeat[15525]: stack: frame={sp:0x7fffd9e39940, fp:0x0} stack=[0x7fffd963af68,0x7fffd9e39fa0)
Mar 08 17:04:30 WC filebeat[15525]: 00007fffd9e39840:  00000000030028af  0000000000dbf9f5
Mar 08 17:04:30 WC filebeat[15525]: 00007fffd9e39850:  0000000000dbf9f5  0000000000000000
Mar 08 17:04:30 WC filebeat[15525]: 00007fffd9e39860:  0000000000000000  0000000004014f40
Mar 08 17:04:30 WC filebeat[15525]: 00007fffd9e39870:  0000000003002878  00007fffd9e39948
Mar 08 17:04:30 WC filebeat[15525]: 00007fffd9e39880:  0000000000f192d4 <runtime.adjustframe+132>  0000000000efb062 <runtime.netpoll+146>
Mar 08 17:04:30 WC filebeat[15525]: 00007fffd9e39890:  0000000000efb062 <runtime.netpoll+146>  00007fff00000003
Mar 08 17:04:30 WC filebeat[15525]: 00007fffd9e398a0:  00007fffd9e398e0  0000000000000080
Mar 08 17:04:30 WC filebeat[15525]: 00007fffd9e398b0:  0000000000000000  0000000000000000
Mar 08 17:04:30 WC filebeat[15525]: 00007fffd9e398c0:  0000000000000000  0000000000000000
Mar 08 17:04:30 WC filebeat[15525]: 00007fffd9e398d0:  0000000000000000  0000000000000000
Mar 08 17:04:30 WC filebeat[15525]: 00007fffd9e398e0:  0000000000000000  0000000000000000
Mar 08 17:04:30 WC filebeat[15525]: 00007fffd9e398f0:  0000000000000000  0000000000000000
Mar 08 17:04:30 WC filebeat[15525]: 00007fffd9e39900:  0000000000000000  0000000000000000
Mar 08 17:04:30 WC filebeat[15525]: 00007fffd9e39910:  0000000000000000  0000000000000000
Mar 08 17:04:30 WC filebeat[15525]: 00007fffd9e39920:  0000000000000000  00007fe62955465c
Mar 08 17:04:30 WC filebeat[15525]: 00007fffd9e39930:  0000000000000000  00007fe62954742e
Mar 08 17:04:30 WC filebeat[15525]: 00007fffd9e39940: <0000000000000130  0000000000000007
Mar 08 17:04:30 WC filebeat[15525]: 00007fffd9e39950:  0000000000000120  142ce523a073e245
Mar 08 17:04:30 WC filebeat[15525]: 00007fffd9e39960:  0000000000000013  0000000000000021
Mar 08 17:04:30 WC filebeat[15525]: 00007fffd9e39970:  0000000000000150  0000000000000004
Mar 08 17:04:30 WC filebeat[15525]: 00007fffd9e39980:  0000003400000013  00007fe6295f56d1
Mar 08 17:04:30 WC filebeat[15525]: 00007fffd9e39990:  00007fe5f2ffd640  00007fffd9e39c50
Mar 08 17:04:30 WC filebeat[15525]: 00007fffd9e399a0:  00007fffd9e39ace  00007fffd9e39acf
Mar 08 17:04:30 WC filebeat[15525]: 00007fffd9e399b0:  00007fe5f2ffd640  00007fe6295452f5
Mar 08 17:04:30 WC filebeat[15525]: 00007fffd9e399c0:  00007fe62969baa0  dee5fc6fdec4ba00
Mar 08 17:04:30 WC filebeat[15525]: 00007fffd9e399d0:  00007fe62949e740  0000000000000006
Mar 08 17:04:30 WC filebeat[15525]: 00007fffd9e399e0:  0000000004410f70  0000000000000000
Mar 08 17:04:30 WC filebeat[15525]: 00007fffd9e399f0:  0000000002cf0118  00007fe6294fad06
Mar 08 17:04:30 WC filebeat[15525]: 00007fffd9e39a00:  00007fe62969d990  00007fe6294cd7d3
Mar 08 17:04:30 WC filebeat[15525]: 00007fffd9e39a10:  0000000000000020  0000000000000000
Mar 08 17:04:30 WC filebeat[15525]: 00007fffd9e39a20:  0000000000000000  00007fe6295e5174
Mar 08 17:04:30 WC filebeat[15525]: 00007fffd9e39a30:  00007fe5f27fd000  000000000000000d
Mar 08 17:04:30 WC filebeat[15525]: goroutine 1 [runnable]:
Mar 08 17:04:30 WC filebeat[15525]: os/signal.signal_enable(0xe7b7cd6d0000000f)
Mar 08 17:04:30 WC filebeat[15525]:         /usr/local/go/src/runtime/sigqueue.go:219 +0x6c
Mar 08 17:04:30 WC filebeat[15525]: os/signal.enableSignal(...)
Mar 08 17:04:30 WC filebeat[15525]:         /usr/local/go/src/os/signal/signal_unix.go:51
Mar 08 17:04:30 WC filebeat[15525]: os/signal.Notify.func2(0xf)
Mar 08 17:04:30 WC filebeat[15525]:         /usr/local/go/src/os/signal/signal.go:150 +0x8e
Mar 08 17:04:30 WC filebeat[15525]: os/signal.Notify(0xc0000150e0, 0xc0006173b8, 0x3, 0x3)
Mar 08 17:04:30 WC filebeat[15525]:         /usr/local/go/src/os/signal/signal.go:162 +0x170
Mar 08 17:04:30 WC filebeat[15525]: github.com/elastic/beats/v7/libbeat/service.HandleSignals(0xc0001b8ca0, 0xc0001ce5f0)
Mar 08 17:04:30 WC filebeat[15525]:         /go/src/github.com/elastic/beats/libbeat/service/service.go:48 +0x122
Mar 08 17:04:30 WC filebeat[15525]: github.com/elastic/beats/v7/libbeat/cmd/instance.(*Beat).launch(0xc0000ce2c0, 0x29fa2ec, 0x8, 0x29fa2ec, 0x8, 0x0, 0x0, 0x1, 0x0, 0>
Mar 08 17:04:30 WC filebeat[15525]:         /go/src/github.com/elastic/beats/libbeat/cmd/instance/beat.go:448 +0x633
Mar 08 17:04:30 WC filebeat[15525]: github.com/elastic/beats/v7/libbeat/cmd/instance.Run.func1(0x29fa2ec, 0x8, 0x29fa2ec, 0x8, 0x0, 0x0, 0xc00060fc30, 0xc000267b30, 0x>
Mar 08 17:04:30 WC filebeat[15525]:         /go/src/github.com/elastic/beats/libbeat/cmd/instance/beat.go:189 +0x55a
Mar 08 17:04:30 WC filebeat[15525]: github.com/elastic/beats/v7/libbeat/cmd/instance.Run(0x29fa2ec, 0x8, 0x29fa2ec, 0x8, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, ...)
Mar 08 17:04:30 WC filebeat[15525]:         /go/src/github.com/elastic/beats/libbeat/cmd/instance/beat.go:190 +0x148
Mar 08 17:04:30 WC filebeat[15525]: github.com/elastic/beats/v7/libbeat/cmd.genRunCmd.func1(0xc0003bcdc0, 0xc00054cfc0, 0x0, 0xc)
Mar 08 17:04:30 WC filebeat[15525]:         /go/src/github.com/elastic/beats/libbeat/cmd/run.go:36 +0x9d
Mar 08 17:04:30 WC filebeat[15525]: github.com/spf13/cobra.(*Command).execute(0xc0003bcdc0, 0xc00004e1b0, 0xc, 0xc, 0xc0003bcdc0, 0xc00004e1b0)
Mar 08 17:04:30 WC filebeat[15525]:         /go/pkg/mod/github.com/spf13/co...@v0.0.5/command.go:830 +0x29d
Mar 08 17:04:30 WC filebeat[15525]: github.com/spf13/cobra.(*Command).ExecuteC(0xc0003bcdc0, 0xc0003bcdc0, 0xffffffff, 0xc0000a2058)
Mar 08 17:04:30 WC filebeat[15525]:         /go/pkg/mod/github.com/spf13/co...@v0.0.5/command.go:914 +0x2fb
Mar 08 17:04:30 WC filebeat[15525]: github.com/spf13/cobra.(*Command).Execute(...)
Mar 08 17:04:30 WC filebeat[15525]:         /go/pkg/mod/github.com/spf13/co...@v0.0.5/command.go:864
Mar 08 17:04:30 WC filebeat[15525]: main.main()
Mar 08 17:04:30 WC filebeat[15525]:         /go/src/github.com/elastic/beats/filebeat/main.go:36 +0x3d
Mar 08 17:04:30 WC filebeat[15525]: goroutine 19 [chan receive]:
Mar 08 17:04:30 WC filebeat[15525]: k8s.io/klog.(*loggingT).flushDaemon(0x4241ce0)
Mar 08 17:04:30 WC filebeat[15525]:         /go/pkg/mod/k8s.io/kl...@v1.0.0/klog.go:1010 +0x8b
Mar 08 17:04:30 WC filebeat[15525]: created by k8s.io/klog.init.0
Mar 08 17:04:30 WC filebeat[15525]:         /go/pkg/mod/k8s.io/kl...@v1.0.0/klog.go:411 +0xd6
Mar 08 17:04:30 WC filebeat[15525]: goroutine 20 [select]:
Mar 08 17:04:30 WC filebeat[15525]: github.com/elastic/beats/v7/libbeat/publisher/queue/memqueue.(*bufferingEventLoop).run(0xc00001a640)
Mar 08 17:04:30 WC filebeat[15525]:         /go/src/github.com/elastic/beats/libbeat/publisher/queue/memqueue/eventloop.go:316 +0x1cf
Mar 08 17:04:30 WC filebeat[15525]: github.com/elastic/beats/v7/libbeat/publisher/queue/memqueue.NewQueue.func1(0xc0001350a0, 0x2d3ed60, 0xc00001a640)
Mar 08 17:04:30 WC filebeat[15525]:         /go/src/github.com/elastic/beats/libbeat/publisher/queue/memqueue/broker.go:171 +0x5f
Mar 08 17:04:30 WC filebeat[15525]: created by github.com/elastic/beats/v7/libbeat/publisher/queue/memqueue.NewQueue
Mar 08 17:04:30 WC filebeat[15525]:         /go/src/github.com/elastic/beats/libbeat/publisher/queue/memqueue/broker.go:169 +0x373
Mar 08 17:04:30 WC filebeat[15525]: goroutine 21 [select]:
Mar 08 17:04:30 WC filebeat[15525]: github.com/elastic/beats/v7/libbeat/publisher/queue/memqueue.(*ackLoop).run(0xc000404c30)
Mar 08 17:04:30 WC filebeat[15525]:         /go/src/github.com/elastic/beats/libbeat/publisher/queue/memqueue/ackloop.go:60 +0x107
Mar 08 17:04:30 WC filebeat[15525]: github.com/elastic/beats/v7/libbeat/publisher/queue/memqueue.NewQueue.func2(0xc0001350a0, 0xc000404c30)
Mar 08 17:04:30 WC filebeat[15525]:         /go/src/github.com/elastic/beats/libbeat/publisher/queue/memqueue/broker.go:175 +0x59
Mar 08 17:04:30 WC filebeat[15525]: created by github.com/elastic/beats/v7/libbeat/publisher/queue/memqueue.NewQueue
Mar 08 17:04:30 WC filebeat[15525]:         /go/src/github.com/elastic/beats/libbeat/publisher/queue/memqueue/broker.go:173 +0x3a2
Mar 08 17:04:30 WC filebeat[15525]: goroutine 22 [select]:
Mar 08 17:04:30 WC filebeat[15525]: github.com/elastic/beats/v7/libbeat/publisher/queue/memqueue.(*consumer).Get(0xc0005301c0, 0x32, 0x0, 0x0, 0x0, 0x0)
Mar 08 17:04:30 WC filebeat[15525]:         /go/src/github.com/elastic/beats/libbeat/publisher/queue/memqueue/consume.go:65 +0xe9
Mar 08 17:04:30 WC filebeat[15525]: github.com/elastic/beats/v7/libbeat/publisher/pipeline.(*eventConsumer).loop(0xc000097f80, 0x2d3eda0, 0xc0005301c0)
Mar 08 17:04:30 WC filebeat[15525]:         /go/src/github.com/elastic/beats/libbeat/publisher/pipeline/consumer.go:182 +0x19a
Mar 08 17:04:30 WC filebeat[15525]: github.com/elastic/beats/v7/libbeat/publisher/pipeline.newEventConsumer.func1(0xc000097f80, 0x2d3eda0, 0xc0005301a0)
Mar 08 17:04:30 WC filebeat[15525]:         /go/src/github.com/elastic/beats/libbeat/publisher/pipeline/consumer.go:86 +0x6c
Mar 08 17:04:30 WC filebeat[15525]: created by github.com/elastic/beats/v7/libbeat/publisher/pipeline.newEventConsumer
Mar 08 17:04:30 WC filebeat[15525]:         /go/src/github.com/elastic/beats/libbeat/publisher/pipeline/consumer.go:84 +0x149
Mar 08 17:04:30 WC filebeat[15525]: goroutine 23 [select]:
Mar 08 17:04:30 WC filebeat[15525]: github.com/elastic/beats/v7/libbeat/publisher/pipeline.(*retryer).loop(0xc000260540)
Mar 08 17:04:30 WC filebeat[15525]:         /go/src/github.com/elastic/beats/libbeat/publisher/pipeline/retry.go:135 +0x250
Mar 08 17:04:30 WC filebeat[15525]: created by github.com/elastic/beats/v7/libbeat/publisher/pipeline.newRetryer
Mar 08 17:04:30 WC filebeat[15525]:         /go/src/github.com/elastic/beats/libbeat/publisher/pipeline/retry.go:94 +0x158
Mar 08 17:04:30 WC filebeat[15525]: goroutine 24 [select]:
Mar 08 17:04:30 WC filebeat[15525]: github.com/elastic/beats/v7/libbeat/publisher/pipeline.(*netClientWorker).run(0xc000260780)
Mar 08 17:04:30 WC filebeat[15525]:         /go/src/github.com/elastic/beats/libbeat/publisher/pipeline/output.go:127 +0xd1
Mar 08 17:04:30 WC filebeat[15525]: created by github.com/elastic/beats/v7/libbeat/publisher/pipeline.makeClientWorker
Mar 08 17:04:30 WC filebeat[15525]:         /go/src/github.com/elastic/beats/libbeat/publisher/pipeline/output.go:79 +0x194
Mar 08 17:04:30 WC filebeat[15525]: goroutine 79 [select]:
Mar 08 17:04:30 WC filebeat[15525]: github.com/elastic/beats/v7/libbeat/monitoring/report/log.(*reporter).snapshotLoop(0xc00085d4d0)
Mar 08 17:04:30 WC filebeat[15525]:         /go/src/github.com/elastic/beats/libbeat/monitoring/report/log/log.go:129 +0x3cb
Mar 08 17:04:30 WC filebeat[15525]: github.com/elastic/beats/v7/libbeat/monitoring/report/log.MakeReporter.func1(0xc00085d4d0)
Mar 08 17:04:30 WC filebeat[15525]:         /go/src/github.com/elastic/beats/libbeat/monitoring/report/log/log.go:107 +0x50
Mar 08 17:04:30 WC filebeat[15525]: created by github.com/elastic/beats/v7/libbeat/monitoring/report/log.MakeReporter
Mar 08 17:04:30 WC filebeat[15525]:         /go/src/github.com/elastic/beats/libbeat/monitoring/report/log/log.go:105 +0x157
Mar 08 17:04:30 WC filebeat[15525]: goroutine 80 [syscall]:
Mar 08 17:04:30 WC filebeat[15525]: os/signal.signal_recv(0x0)
Mar 08 17:04:30 WC filebeat[15525]:         /usr/local/go/src/runtime/sigqueue.go:147 +0x9c
Mar 08 17:04:30 WC filebeat[15525]: os/signal.loop()
Mar 08 17:04:30 WC filebeat[15525]:         /usr/local/go/src/os/signal/signal_unix.go:23 +0x22
Mar 08 17:04:30 WC filebeat[15525]: created by os/signal.Notify.func1
Mar 08 17:04:30 WC filebeat[15525]:         /usr/local/go/src/os/signal/signal.go:127 +0x44
Mar 08 17:04:30 WC filebeat[15525]: rax    0x0
Mar 08 17:04:30 WC filebeat[15525]: rbx    0x7fe62949e740
Mar 08 17:04:30 WC filebeat[15525]: rcx    0x7fe62954743c
Mar 08 17:04:30 WC filebeat[15525]: rdx    0x6
Mar 08 17:04:30 WC filebeat[15525]: rdi    0x3ca5
Mar 08 17:04:30 WC filebeat[15525]: rsi    0x3ca5
Mar 08 17:04:30 WC filebeat[15525]: rbp    0x3ca5
Mar 08 17:04:30 WC filebeat[15525]: rsp    0x7fffd9e39940
Mar 08 17:04:30 WC filebeat[15525]: r8     0x7fffd9e39a10
Mar 08 17:04:30 WC filebeat[15525]: r9     0x7fe6296574e0
Mar 08 17:04:30 WC filebeat[15525]: r10    0x8
Mar 08 17:04:30 WC filebeat[15525]: r11    0x246
Mar 08 17:04:30 WC filebeat[15525]: r12    0x6
Mar 08 17:04:30 WC filebeat[15525]: r13    0x0
Mar 08 17:04:30 WC filebeat[15525]: r14    0x2cf0118
Mar 08 17:04:30 WC filebeat[15525]: r15    0x0
Mar 08 17:04:30 WC filebeat[15525]: rip    0x7fe62954743c
Mar 08 17:04:30 WC filebeat[15525]: rflags 0x246
Mar 08 17:04:30 WC filebeat[15525]: cs     0x33
Mar 08 17:04:30 WC filebeat[15525]: fs     0x0
Mar 08 17:04:30 WC filebeat[15525]: gs     0x0
Mar 08 17:04:30 WC systemd[1]: filebeat.service: Main process exited, code=exited, status=2/INVALIDARGUMENT
░░ Subject: Unit process exited
░░ Defined-By: systemd
░░ Support: https://access.redhat.com/support
░░
░░ An ExecStart= process belonging to unit filebeat.service has exited.
░░
░░ The process' exit code is 'exited' and its exit status is 2.
Mar 08 17:04:30 WC systemd[1]: filebeat.service: Failed with result 'exit-code'.
░░ Subject: Unit failed
░░ Defined-By: systemd
░░ Support: https://access.redhat.com/support
░░
░░ The unit filebeat.service has entered the 'failed' state with result 'exit-code'.
Mar 08 17:04:30 WC systemd[1]: filebeat.service: Scheduled restart job, restart counter is at 5.
░░ Subject: Automatic restarting of a unit has been scheduled
░░ Defined-By: systemd
░░ Support: https://access.redhat.com/support
░░
░░ Automatic restarting of the unit filebeat.service has been scheduled, as the result for
░░ the configured Restart= setting for the unit.
Mar 08 17:04:30 WC systemd[1]: Stopped Filebeat sends log files to Logstash or directly to Elasticsearch..
░░ Subject: A stop job for unit filebeat.service has finished
░░ Defined-By: systemd
░░ Support: https://access.redhat.com/support
░░
░░ A stop job for unit filebeat.service has finished.
░░
░░ The job identifier is 12395 and the job result is done.
Mar 08 17:04:30 WC systemd[1]: filebeat.service: Start request repeated too quickly.
Mar 08 17:04:30 WC systemd[1]: filebeat.service: Failed with result 'exit-code'.
░░ Subject: Unit failed
░░ Defined-By: systemd
░░ Support: https://access.redhat.com/support
░░
░░ The unit filebeat.service has entered the 'failed' state with result 'exit-code'.
Mar 08 17:04:30 WC systemd[1]: Failed to start Filebeat sends log files to Logstash or directly to Elasticsearch..
░░ Subject: A start job for unit filebeat.service has failed
░░ Defined-By: systemd
░░ Support: https://access.redhat.com/support
░░
░░ A start job for unit filebeat.service has finished with a failure.
░░
░░ The job identifier is 12395 and the job result is failed.

[Jonathan Martín Valera]

Hi,

Note the following lines:

Mar 08 17:04:29 WC filebeat[15500]: runtime/cgo: pthread_create failed: Operation not permitted
Mar 08 17:04:29 WC filebeat[15500]: SIGABRT: abort

I wonder if you are not running out of resources and, hence, unable to create POSIX threads. También puede ser debido a una posible política restrictiva de recursos, that caps their ability to create file descriptors, processes, and open files.

What operating system are you using?

I have also seen that another user reported a similar case some time ago, and it seems that after switching from Fedora to CentOS he solved his problem https://groups.google.com/g/wazuh/c/uDDVhaWMQTM/m/mDMXw6vOBQAJ

Anyway, first you should check if there is any resource limitation in your system that is causing this error, and then check if for some reason your operating system is not compatible with Filebeat (you can see the compatibility matrix here https://www.elastic.co/support/matrix, you will have to look for the Filebeat one).

In any case, if you say that it worked for a while and then stopped working, perhaps it is because of the first case, although the second cannot be ruled out either.

I would investigate this way, and if not, try reinstalling Filebeat again, then try it on another operating system….

Try it and let us know the results.

​

[Sid J]

Hi,

I am running wazuh 4.2 on CentOS Stream 9 with all resources available.

I have checked and can't see a filebeat compatible version for CentOS stream 9 but it was working fine earlier.

--
You received this message because you are subscribed to the Google Groups "Wazuh mailing list" group.
To unsubscribe from this group and stop receiving emails from it, send an email to wazuh+un...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/wazuh/46fc29bb-fe62-4d7d-a6ac-b80e633a66c9n%40googlegroups.com.

[Jonathan Martín Valera]

Hi,

I have been testing Filebeat in CentOS Stream 9 and I managed to reproduce your error.

At first, it worked normally, but after a while, it stopped because of the same error:

Mar 09 11:10:21 c1 filebeat[4043]: runtime/cgo: pthread_create failed: Operation not permitted
Mar 09 11:10:21 c1 filebeat[4043]: SIGABRT: abort

It is probably due to an operating system problem or incompatibility of Filebeat with that operating system.

I recommend you to open a thread in the Elastic forum, maybe they can give us a more in-depth explanation about this issue.

In the meantime, I recommend that if you can, you use an operating system that is officially compatible with the components involved.

Note: In Wazuh v5.x, the Filebeat component will no longer be necessary, so we will avoid possible problems like these :)

Regards.

​

[khawla Makhzoumi]

Bonjour ,je n'arrive pas a trouver filebeat dans Kibana malgré j'ai tout fait

any help please

[Jonathan Martín Valera]

Hi,

What do you mean when you say that you cannot find the Filebeat in Kibana? Let’s say that Filebeat is an independent process, which is responsible for sending the alerts that are in the /var/ossec/bin/alerts/alerts.json file to Elasticsearch, where they are stored and indexed to be later displayed on Kibana.

Take a look at the Filebeat installation here, and note that the installation process is separated from the Kibana one.

Regards.

​