# Auditbeat, filebeat and journalbeat in kubernetes

**URL:** <https://discuss.elastic.co/t/auditbeat-filebeat-and-journalbeat-in-kubernetes/291805>\
**Category:** Beats\
**Tags:** elastic-stack-security, filebeat, elastic-agent\
**Created:** [December 14, 2021, 1:11pm UTC](https://discuss.elastic.co/t/auditbeat-filebeat-and-journalbeat-in-kubernetes/291805 "2021-12-14T13:11:29Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Dmitriy\_Esin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dmitriy_esin/32/95725_2.png) [@Dmitriy\_Esin](https://discuss.elastic.co/u/Dmitriy_Esin)\
**Post date:** [December 14, 2021, 1:11pm UTC](https://discuss.elastic.co/t/auditbeat-filebeat-and-journalbeat-in-kubernetes/291805/1 "2021-12-14T13:11:30Z")

</div>

Hi all!  
I want to get an assistant with filebeat and auditbeat deployed in the k8s cluster.  
Here are my yamls:

Auditbeat:

> <https://github.com/DmitriyEsin/elk_yml/blob/63b8d163e8e87c384604cfea4dc11c51adb6d7d4/auditbeat.yml>

Filebeat:

> <https://github.com/DmitriyEsin/elk_yml/blob/63b8d163e8e87c384604cfea4dc11c51adb6d7d4/filebeat.yml>

It runs successfully and has logs:

Auditbeat:

> <https://github.com/DmitriyEsin/elk_yml/blob/b2cb6f0cf26211eff3993509af18af3678dcdc44/auditbeat.log>

Fiebeat:

> <https://github.com/DmitriyEsin/elk_yml/blob/e05e484ce9470916f93d39c29acd534e5184acc2/filebeat.log>

But I can't see any data from agents in kibana dashboards (kibana configured in yamls).

Also, I can't find any yaml for journalbeat on the official website:

 ![Screenshot 2021-12-14 at 15.59.47](https://us1.discourse-cdn.com/elastic/original/3X/4/f/4f0d65c5a5b3e2aa17a890121670cea0bb0e0c1b.jpeg)

---

<div class="post-metadata">

**Author:** ![Dmitriy\_Esin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dmitriy_esin/32/95725_2.png) [@Dmitriy\_Esin](https://discuss.elastic.co/u/Dmitriy_Esin)\
**Post date:** [December 15, 2021, 6:24pm UTC](https://discuss.elastic.co/t/auditbeat-filebeat-and-journalbeat-in-kubernetes/291805/2 "2021-12-15T18:24:51Z")

</div>

I noticed that when I do `./elastic-agent inspect output -o default` in the pod  
Output is a default in spite of configured values in yaml.  
 ![Screenshot 2021-12-15 at 21.22.59](https://us1.discourse-cdn.com/elastic/original/3X/c/5/c5eda2f67dbe8e9eb777f0a45b2fe1257186c06a.png)  
Any ideas?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 12, 2022, 8:24pm UTC](https://discuss.elastic.co/t/auditbeat-filebeat-and-journalbeat-in-kubernetes/291805/3 "2022-01-12T20:24:56Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.