# Error in fetching the logs Filebeat 7.3.2
**URL:** https://discuss.elastic.co/t/error-in-fetching-the-logs-filebeat-7-3-2/214168
**Category:** Beats
**Tags:** filebeat
**Created:** [January 8, 2020, 7:15am UTC](https://discuss.elastic.co/t/error-in-fetching-the-logs-filebeat-7-3-2/214168 "2020-01-08T07:15:27Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@Anwesha\_Pokra](https://discuss.elastic.co/u/Anwesha_Pokra)
#### Post date: [January 8, 2020, 7:15am UTC](https://discuss.elastic.co/t/error-in-fetching-the-logs-filebeat-7-3-2/214168/1 "2020-01-08T07:15:27Z")
Hi,
I am trying to pass the pod logs to elasticsearch using filebeat, but logs are not appearing in the filebeat pod log. I am deploying the filebeat as kubernetes pod.
kubernetes version - 1.12.7
docker version - 1.18
filebeat version - 7.3.2
elastic version -7.3.2
kibana version - 7.3.2
Below is the filebeat-kubernetes.yaml file configuration -
* * *
apiVersion: v1
kind: ConfigMap
metadata:
name: filebeat-config
namespace: elk
labels:
k8s-app: filebeat
data:
filebeat.yml: |-
filebeat.inputs:
- type: container
paths:
- /var/log/containers/_.log
processors:
- add\_kubernetes\_metadata:
host: {NODE\_NAME} matchers: - logs\_path: logs\_path: "/var/log/containers/" client\_inactivity\_timeout: 5m multiline.pattern: '^[0-9]{2}:[0-9]{2}' multiline.negate: true multiline.match: after # To enable hints based autodiscover, remove `filebeat.inputs` configuration and uncomment this: #filebeat.autodiscover: # providers: # - type: kubernetes # host: {NODE\_NAME}
# hints.enabled: true
# hints.default\_config:
# type: container
# paths:
# - /var/log/containers/_${data.kubernetes.container.id}.log
```
processors:
- add_cloud_metadata:
- add_host_metadata:
cloud.id: ${ELASTIC_CLOUD_ID}
cloud.auth: ${ELASTIC_CLOUD_AUTH}
output.elasticsearch:
hosts: ['${ELASTICSEARCH_HOST:10.9.0.131}:${ELASTICSEARCH_PORT:9200}']
```
* * *
## apiVersion: apps/v1 kind: DaemonSet metadata: name: filebeat namespace: elk labels: k8s-app: filebeat spec: selector: matchLabels: k8s-app: filebeat template: metadata: labels: k8s-app: filebeat spec: serviceAccountName: filebeat terminationGracePeriodSeconds: 30 hostNetwork: true dnsPolicy: ClusterFirstWithHostNet containers: - name: filebeat image: [docker.elastic.co/beats/filebeat:7.4.0](http://docker.elastic.co/beats/filebeat:7.4.0) args: ["-c", "/etc/filebeat.yml", "-e",] env: - name: ELASTICSEARCH\_HOST value: 10.9.0.131 - name: ELASTICSEARCH\_PORT value: "9200" - name: NODE\_NAME valueFrom: fieldRef: fieldPath: spec.nodeName securityContext: runAsUser: 0 # If using Red Hat OpenShift uncomment this: #privileged: true resources: limits: memory: 200Mi requests: cpu: 100m memory: 100Mi volumeMounts: - name: config mountPath: /etc/filebeat.yml readOnly: true subPath: filebeat.yml - name: data mountPath: /usr/share/filebeat/data - name: varlibdockercontainers mountPath: /var/lib/docker/containers readOnly: true - name: varlog mountPath: /var/log readOnly: true volumes: - name: config configMap: defaultMode: 0600 name: filebeat-config - name: varlibdockercontainers hostPath: path: /var/lib/docker/containers - name: varlog hostPath: path: /var/log # data folder stores a registry of read status for all files, so we don't send everything again on a Filebeat pod restart - name: data hostPath: path: /var/lib/filebeat-data type: DirectoryOrCreate
apiVersion: [rbac.authorization.k8s.io/v1](http://rbac.authorization.k8s.io/v1)
kind: ClusterRoleBinding
metadata:
name: filebeat
subjects:
- kind: ServiceAccount
name: filebeat
namespace: elk
roleRef:
kind: ClusterRole
name: filebeat
apiGroup: [rbac.authorization.k8s.io](http://rbac.authorization.k8s.io)
* * *
apiVersion: [rbac.authorization.k8s.io/v1](http://rbac.authorization.k8s.io/v1)
kind: ClusterRole
metadata:
name: filebeat
labels:
k8s-app: filebeat
rules:
- apiGroups: [""] # "" indicates the core API group
resources:
- namespaces
- pods
verbs:
- get
- watch
- list
* * *
## apiVersion: v1 kind: ServiceAccount metadata: name: filebeat namespace: elk labels: k8s-app: filebeat
---
### Author:  [@faec](https://discuss.elastic.co/u/faec)
#### Post date: [January 9, 2020, 7:29pm UTC](https://discuss.elastic.co/t/error-in-fetching-the-logs-filebeat-7-3-2/214168/2 "2020-01-09T19:29:15Z")
Welcome! Sorry you're having trouble -- it's hard to read the configuration in that layout, could you share it again as preformatted text to preserve format / spacing? You can use a triple-backtick (```) to do it, like this:
```
[config file goes here]
```
Also, can you get a log file from one of the filebeat instances? It's hard to guess what's wrong from just a general configuration, but the log files should tell us what specifically is breaking.
---
### Author:  [@Anwesha\_Pokra](https://discuss.elastic.co/u/Anwesha_Pokra)
#### Post date: [January 10, 2020, 6:13am UTC](https://discuss.elastic.co/t/error-in-fetching-the-logs-filebeat-7-3-2/214168/3 "2020-01-10T06:13:08Z")
```auto
---
apiVersion: v1
kind: ConfigMap
metadata:
name: filebeat-config
namespace: elk
labels:
k8s-app: filebeat
data:
filebeat.yml: |-
filebeat.inputs:
- type: container
paths:
- /var/log/containers/*.log
processors:
- add_kubernetes_metadata:
host: ${NODE_NAME}
matchers:
- logs_path:
logs_path: "/var/log/containers/"
client_inactivity_timeout: 5m
multiline.pattern: '^[0-9]{2}:[0-9]{2}'
multiline.negate: true
multiline.match: after
# To enable hints based autodiscover, remove `filebeat.inputs` configuration and uncomment this:
#filebeat.autodiscover:
# providers:
# - type: kubernetes
# host: ${NODE_NAME}
# hints.enabled: true
# hints.default_config:
# type: container
# paths:
# - /var/log/containers/*${data.kubernetes.container.id}.log
processors:
- add_cloud_metadata:
- add_host_metadata:
cloud.id: ${ELASTIC_CLOUD_ID}
cloud.auth: ${ELASTIC_CLOUD_AUTH}
output.elasticsearch:
hosts: ['${ELASTICSEARCH_HOST:10.9.0.131}:${ELASTICSEARCH_PORT:9200}']
---
apiVersion: apps/v1
kind: DaemonSet
metadata:
name: filebeat
namespace: elk
labels:
k8s-app: filebeat
spec:
selector:
matchLabels:
k8s-app: filebeat
template:
metadata:
labels:
k8s-app: filebeat
spec:
serviceAccountName: filebeat
terminationGracePeriodSeconds: 30
hostNetwork: true
dnsPolicy: ClusterFirstWithHostNet
containers:
- name: filebeat
image: docker.elastic.co/beats/filebeat:7.4.0
args: [
"-c", "/etc/filebeat.yml",
"-e",
]
env:
- name: ELASTICSEARCH_HOST
value: 10.9.0.131
- name: ELASTICSEARCH_PORT
value: "9200"
- name: NODE_NAME
valueFrom:
fieldRef:
fieldPath: spec.nodeName
securityContext:
runAsUser: 0
# If using Red Hat OpenShift uncomment this:
#privileged: true
resources:
limits:
memory: 200Mi
requests:
cpu: 100m
memory: 100Mi
volumeMounts:
- name: config
mountPath: /etc/filebeat.yml
readOnly: true
subPath: filebeat.yml
- name: data
mountPath: /usr/share/filebeat/data
- name: varlibdockercontainers
mountPath: /var/lib/docker/containers
readOnly: true
- name: varlog
mountPath: /var/log
readOnly: true
volumes:
- name: config
configMap:
defaultMode: 0600
name: filebeat-config
- name: varlibdockercontainers
hostPath:
path: /var/lib/docker/containers
- name: varlog
hostPath:
path: /var/log
# data folder stores a registry of read status for all files, so we don't send everything again on a Filebeat pod restart
- name: data
hostPath:
path: /var/lib/filebeat-data
type: DirectoryOrCreate
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: filebeat
subjects:
- kind: ServiceAccount
name: filebeat
namespace: elk
roleRef:
kind: ClusterRole
name: filebeat
apiGroup: rbac.authorization.k8s.io
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: filebeat
labels:
k8s-app: filebeat
rules:
- apiGroups: [""] # "" indicates the core API group
resources:
- namespaces
- pods
verbs:
- get
- watch
- list
---
apiVersion: v1
kind: ServiceAccount
metadata:
name: filebeat
namespace: elk
labels:
k8s-app: filebeat
---
```
---
### Author:  [@Anwesha\_Pokra](https://discuss.elastic.co/u/Anwesha_Pokra)
#### Post date: [January 10, 2020, 6:15am UTC](https://discuss.elastic.co/t/error-in-fetching-the-logs-filebeat-7-3-2/214168/4 "2020-01-10T06:15:46Z")
---
### Author:  [@Anwesha\_Pokra](https://discuss.elastic.co/u/Anwesha_Pokra)
#### Post date: [January 10, 2020, 10:13am UTC](https://discuss.elastic.co/t/error-in-fetching-the-logs-filebeat-7-3-2/214168/5 "2020-01-10T10:13:11Z")
Hi,
I have attached the filebeat log screenshot and filebeat.yaml in preformatted text on the discussion portal. Kindly check and let me know if you can guide to resolve the issue .
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 7, 2020, 10:13am UTC](https://discuss.elastic.co/t/error-in-fetching-the-logs-filebeat-7-3-2/214168/6 "2020-02-07T10:13:17Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.