diff --git a/fluentd/run.sh b/fluentd/run.sh
index 853d5eb07..9173b6822 100644
--- a/fluentd/run.sh
+++ b/fluentd/run.sh
@@ -99,6 +99,12 @@ if [ -z $ES_PORT ]; then
     exit 1
 fi
 
+# Check bearer_token_file for fluent-plugin-kubernetes_metadata_filter.
+if [ ! -s /var/run/secrets/kubernetes.io/serviceaccount/token ] ; then
+    echo "ERROR: Bearer_token_file (/var/run/secrets/kubernetes.io/serviceaccount/token) to access the Kubernetes API server is missing or empty."
+    exit 1
+fi
+
 # How many outputs?
 # check ES_HOST vs. OPS_HOST; ES_PORT vs. OPS_PORT
 if [ "$ES_HOST" = ${OPS_HOST:-""} -a $ES_PORT -eq ${OPS_PORT:-0} ]; then