filebeat7.4停止采集kubernetes日志

kubernetes中以daemon方式部署filebeat7.4，运行一段时间后停止采集日志，只有重新启动filebeat才会重新采集，filebeat日志级别为info，没有明显报错信息，以下是config配置

  filebeat.yml: |-
    filebeat.config:
      modules:
        path: ${path.config}/modules.d/*.yml
        reload.enabled: true                
    filebeat.autodiscover:
      providers:
        - type: kubernetes
          host: ${NODE_NAME}
          templates:
            - condition:
                or:
                  - contains:
                      kubernetes.namespace: dev-xx1
                  - contains:
                      kubernetes.namespace: dev-xx2
                  - contains:
                      kubernetes.namespace: dev-xx3
                  - contains:
                      kubernetes.namespace: dev-xx4
              config:
                - type: container
                  paths:
                    - /var/log/containers/*-${data.kubernetes.container.id}.log
                  exclude_lines: ["^\\s+[\\-`('.|_]"]
                  multiline:
                    pattern: '^\['
                    negate: true
                    match: after
    setup.template.enabled: true                                       
    setup.template.name: "k8s-dev" 
    setup.template.pattern: "k8s-dev-*"
    setup.template.overwrite: true
    setup.ilm.enabled: false
    setup.ilm.rollover_alias: "k8s-dev"
    setup.ilm.pattern: "{now/d}-000001" 
    setup.template.settings:
      index.number_of_shards: 3
      index.codec: best_compression
      _source.enabled: true                     
    processors:
      - add_kubernetes_metadata:
          in_cluster: true
      - drop_fields:
          fields: ['beat.name','beat.hostname','input.type','kubernetes.labels.pod-template-hash','kubernetes.labels.workload.user.cattle.io/workloadselector','kubernetes.replicaset.name','prospector.type']      
    output.elasticsearch:
      enable: true
      worker: 3
      hosts: ["http://ip:9200","http://ip:9200","http://ip:9200"]
      username: ${ELASTICSEARCH_USERNAME}
      password: ${ELASTICSEARCH_PASSWORD}
      index: "k8s-dev-%{+yyyy.MM.dd}"
    logging.level: info
 
 
filebeat日志截图如下，求大佬帮助，不胜感激