# Can't get \`co.elastic.logs/raw\` hint to work

**URL:** <https://discuss.elastic.co/t/cant-get-co-elastic-logs-raw-hint-to-work/372640>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [December 30, 2024, 9:35pm UTC](https://discuss.elastic.co/t/cant-get-co-elastic-logs-raw-hint-to-work/372640 "2024-12-30T21:35:24Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![rkrzewski](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rkrzewski/32/138211_2.png) [@rkrzewski](https://discuss.elastic.co/u/rkrzewski)\
**Post date:** [December 30, 2024, 9:35pm UTC](https://discuss.elastic.co/t/cant-get-co-elastic-logs-raw-hint-to-work/372640/1 "2024-12-30T21:35:24Z")

</div>

I'm running ELK 8.15.0 on Kubernetes using ECK operator.

My cluster-wide filebeat configuration set in a [beat.k8s.elastic.co/v1beta1](http://beat.k8s.elastic.co/v1beta1) Beat resource is the following:

```auto
    filebeat:
      autodiscover:
        providers:
          - type: kubernetes
            node: ${NODE_NAME}
            add_resource_metadata:
              node:
                enabled: false
              cronjob: true
              deployment: true
            hints:
              enabled: true
              default_config:
                enabled: false
                type: container
                paths:
                  - /var/log/containers/*${data.kubernetes.container.id}.log

```

I override it for specific pods using annotations:

```auto
co.elastic.logs.app/enabled: 'true'
co.elastic.logs.app/multiline.type: 'pattern'
co.elastic.logs.app/multiline.pattern: '^[0-9:.,TZ-]{24} '
co.elastic.logs.app/multiline.negate: 'true'
co.elastic.logs.app/multiline.match: 'after'
co.elastic.logs.app/processors.1.dissect.tokenizer: '%{@timestamp} %{log.level} [%{log.logger}] (%{process.thread.name}) %{message}'
co.elastic.logs.app/processors.1.dissect.target_prefix: ''
co.elastic.logs.app/processors.1.dissect.overwrite_keys: 'true'
co.elastic.logs.app/processors.1.dissect.trim_values: 'right'

```

The thing that I am trying to do is running `decode_json_fields` processor on log entries with a specific `log.logger` value.  
As I understand, I need to add the following processor at index 2:

```auto
  - decode_json_fields:
      when:
        equals:
          log.logger: webservices
      fields:
        - message
      target: webservices
      process_array: true
      max_depth: 10

```

However, I don't think the `when equals` condition can be expressed using an annotation because `log.logger` field name contains a dot.

I was trying to work around that using `co.elsastic.logs/raw` annotation but I found out that no matter what I put into it, no logs were collected from the pod, ie the global `enabled: false` configuration was in effect. Before I get to adding the new processor I need to get log collection to work again.

When trying to narrow down the problem I found that the following works (logs are collected):

```auto
co.elastic.logs/enabled: "true"

```

But none of the following works (logs are not collected):

```auto
co.elastic.logs/raw: "{\"enabled\":\"true\"}"

```

[Hints based autodiscover | Filebeat Reference [8.17] | Elastic](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-autodiscover-hints.html#_co_elastic_logsraw) uses an array in the example:

```auto
co.elastic.logs/raw: "[{\"enabled\":\"true\"}]"

```

Trying to replicate the content of the global configuration:

```auto
co.elastic.logs/raw: "{\"enabled\":\"true\",\"type\":\"container\",\"paths\":[\"/var/log/containers/*${data.kubernetes.container.id}.log\"]}"

```

I have a suspicion that it might be an character escaping problem, so to be clear I'm showing the annotations above as they appear in the manifest (rendered by Helm) before being applied to the cluster.

Am I making some obvious mistake?

How can I debug that? Can I somehow list live input definitions in the filebeat agent pods running in the cluster? Can I bump logging level somewhere to get information how the hints are being processed?

Any tips appreciated, thanks in advance!