Troubleshooting Filebeat Pods After Kubernetes Upgrade

When upgrading Kubernetes (particularly from version 1.25 to 1.26), you may experience issues with Filebeat pods entering a crash loop state. This is often related to the Elasticsearch service that Filebeat depends on. Resolution Steps First, check if Elasticsearch is running properly in your tenant: Navigate to Docker Services in your tenant Look for EC2 instance where the Elasticsearch Docker container are running. Verify the service status and that the associated EC2 instance is connected If EC2 is not Disconnected Status: Login to AWS Console ssh into the ec2 instance Restart the docker services Validate if all the docker container are in running status. Go to Administrator --> Observability --> Standard --> Settings Enabled Logging for the tenant to deploy filebeat pods on the EKS cluster which connects to ElasticSearch Docker container Go to Administrator --> Observability --> Standard --> Logging Now you should see the logs For Reference: https://github.com/duplocloud-internal/wiki/wiki/Host-is-disconnected-in-DuploCloud-portal This issue typically affects individual tenants and may not impact all environments. If you see Filebeat running correctly in other tenants, the issue is likely isolated to the specific tenant experiencing problems. After following these steps, your logging infrastructure should return to normal operation with Filebeat pods running successfully.