1、查看报错

journalctl -u filebeat
或者
filebeat -c /etc/filebeat/filebeat.yml

找到报错信息
runtime/cgo: pthread_create failed: Operation not permitted

2、解决报错

在filebeat.yml配置文件添加如下配置，重启filebeat

seccomp:
  default_action: allow 
  syscalls:
  - action: allow
    names:
    - rseq

3、验证

systemctl restart filebeat
systemctl status filebeat
ps -ef|grep filebeat