# Fileabeat in UAT is 8.2.0 filebeat in PROD is 7.9.3

**URL:** <https://discuss.elastic.co/t/fileabeat-in-uat-is-8-2-0-filebeat-in-prod-is-7-9-3/351682>\
**Category:** Logstash\
**Tags:** elastic-stack-monitoring\
**Created:** [January 24, 2024, 7:06am UTC](https://discuss.elastic.co/t/fileabeat-in-uat-is-8-2-0-filebeat-in-prod-is-7-9-3/351682 "2024-01-24T07:06:59Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Hanuma](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hanuma/32/131061_2.png) [@Hanuma](https://discuss.elastic.co/u/Hanuma)\
**Post date:** [January 24, 2024, 7:06am UTC](https://discuss.elastic.co/t/fileabeat-in-uat-is-8-2-0-filebeat-in-prod-is-7-9-3/351682/1 "2024-01-24T07:06:59Z")

</div>

Hi Team,

Can you please let us know the difference between filebeat version 7.9.3 and 8.2.0. Will this create issue in Available fields in Elastic search.

we have issue in Available fields not showing in PROD those required, but they are showing in UAT. Even we have same configurations in PROD and UAT.

Below Fields are coming in UAT (FileBeat agent version 8.2.0) not coming in PROD (Filebeat Agent version 7.9.3).

kubernetes.​namespace\_labels.​kubernetes\_io/metadata\_name  
kubernetes.​namespace\_uid  
kubernetes.​node.​hostname  
kubernetes.​node.​labels.​beta\_kubernetes\_io/arch  
kubernetes.​node.​labels.​beta\_kubernetes\_io/instance-type  
kubernetes.​node.​labels.​beta\_kubernetes\_io/os  
kubernetes.​node.​labels.​eks\_amazonaws\_com/capacityType  
kubernetes.​node.​labels.​eks\_amazonaws\_com/nodegroup  
kubernetes.​node.​labels.​eks\_amazonaws\_com/nodegroup-image  
kubernetes.​node.​labels.​eks\_amazonaws\_com/sourceLaunchTemplateId  
kubernetes.​node.​labels.​eks\_amazonaws\_com/sourceLaunchTemplateVersion  
kubernetes.​node.​labels.​failure-domain\_beta\_kubernetes\_io/region  
kubernetes.​node.​labels.​failure-domain\_beta\_kubernetes\_io/zone  
kubernetes.​node.​labels.​k8s\_io/cloud-provider-aws  
kubernetes.​node.​labels.​kubernetes\_io/arch  
kubernetes.​node.​labels.​kubernetes\_io/hostname  
kubernetes.​node.​labels.​kubernetes\_io/os  
kubernetes.​node.​labels.​node\_kubernetes\_io/instance-type  
kubernetes.​node.​labels.​topology\_kubernetes\_io/region  
kubernetes.​node.​labels.​topology\_kubernetes\_io/zone  
kubernetes.​node.​labels.​vpc\_amazonaws\_com/eniConfig  
kubernetes.​node.​labels.​vpc\_amazonaws\_com/has-trunk-attached  
kubernetes.​node.​uid  
kubernetes.​pod.​ip

we have below filter in Logstash.

date {  
match =\> ["timestamp" , "dd/MMM/YYYY:HH:mm:ss Z"]  
target =\> "timestamp"  
}  
if ([message] =~ /nested exception/) {  
mutate {  
add\_field =\> ["nested\_exception", "nested exception"]  
}

```
             }

    }
            else if (([kubernetes][container][name] == "controller") and [kubernetes][namespace] == "Prod") {
            grok {
                    match => ["message" , '%{IPORHOST:clientip} - %{USER:user_name} \[%{HTTPDATE:timestamp}\] "%{WORD:verb} %{DATA:request} HTTP/%{NUMBER:httpversion}" %{NUMBER:response_code:int} (?:-|%{NUMBER:bytes:int}) "(?:%{GREEDYDATA:referrer}|-)" "(?:%{DATA:useragent}|-)" %{NUMBER:request_length:int} %{NUMBER:request_time:float} \[%{GREEDYDATA:proxy_upstream_name}\] \[%{GREEDYDATA:proxy_alternative_upstream_name}\] %{IPORHOST:upstream_addr}:%{NUMBER:port} %{NUMBER:response_length:int} %{NUMBER:response_time:float} %{NUMBER:upstream_status:int} %{GREEDYDATA:req_id}' ]
            }

            date {
                    match => ["timestamp" , "dd/MMM/YYYY:HH:mm:ss Z"]
                    target => "timestamp"
            }
	    }

```

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [January 24, 2024, 12:53pm UTC](https://discuss.elastic.co/t/fileabeat-in-uat-is-8-2-0-filebeat-in-prod-is-7-9-3/351682/2 "2024-01-24T12:53:45Z")

</div>

You need to share the configuration of both your filebeats.

Also, since you also have logstash, you didn't specify the version you are using in your environments, what are the version of the logstash in each environment?

---

<div class="post-metadata">

**Author:** ![Hanuma](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hanuma/32/131061_2.png) [@Hanuma](https://discuss.elastic.co/u/Hanuma)\
**Post date:** [January 24, 2024, 1:35pm UTC](https://discuss.elastic.co/t/fileabeat-in-uat-is-8-2-0-filebeat-in-prod-is-7-9-3/351682/3 "2024-01-24T13:35:42Z")

</div>

we have upgrade the filebeat version, issue resolved now.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 21, 2024, 1:36pm UTC](https://discuss.elastic.co/t/fileabeat-in-uat-is-8-2-0-filebeat-in-prod-is-7-9-3/351682/4 "2024-02-21T13:36:23Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.