1、查看报错

journalctl -u filebeat
或者
filebeat -c /etc/filebeat/filebeat.yml

找到报错信息
runtime/cgo: pthread_create failed: Operation not permitted

2、解决报错

在filebeat.yml配置文件添加如下配置，重启filebeat

seccomp:default_action: allow syscalls:- action: allownames:- rseq

3、验证

systemctl restart filebeat
systemctl status filebeat
ps -ef|grep filebeat