# Filebeat 7.13.4 + Kubernetes 1.20: Hints-Based Autodiscover

**URL:** <https://discuss.elastic.co/t/filebeat-7-13-4-kubernetes-1-20-hints-based-autodiscover/286421>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [October 12, 2021, 12:55am UTC](https://discuss.elastic.co/t/filebeat-7-13-4-kubernetes-1-20-hints-based-autodiscover/286421 "2021-10-12T00:55:14Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![DougR](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dougr/32/48095_2.png) [@DougR](https://discuss.elastic.co/u/DougR)\
**Post date:** [October 12, 2021, 12:55am UTC](https://discuss.elastic.co/t/filebeat-7-13-4-kubernetes-1-20-hints-based-autodiscover/286421/1 "2021-10-12T00:55:14Z")

</div>

We just upgraded our Kubernetes cluster to 1.20 (current version of filebeat is 7.13.4). Of course, this means that Kubernetes logs are no longer in the same place they were under 1.19, and instead are in the following location:

```bash
/var/logs/containers/*-<container_id>.log

```

We use hints-based autodiscover in our cluster, with annotations only; there is no default defined.

Since my previous autodiscover rule is no longer working:

```yml
- type: 'kubernetes'
  hints:
    enabled: true
    default_config:
      enabled: false
  processors:
    - add_kubernetes_metadata: ~

```

I've updated my autodiscover provider rule to the following:

```yaml
- type: 'kubernetes'
  combine_partial: true
  cri:
    force: true
    parse_flags: true
  hints:
    enabled: true
    default_config:
      enabled: false
  paths:
    - '/var/log/containers/*-${data.container.id}.log'
  processors:
    - add_kubernetes_metadata: ~

```

However, my logs aren't ingesting as expected. I'm certain that I just have my provider misconfigured, but I've tried several variations, without any success. When I run filebeat in debug mode, it seems to locate the annotated containers, but the rules don't load.

## Edit:

No matter what I do for the config, it attempts to load the `dockerd` paths:

```bash
2021-10-12T01:34:06.647Z INFO log/input.go:157 Configured paths: [/var/lib/docker/containers/3716ebf97e0353a0f7ac9a0328c0142d87ee8370c25669846b4914e34ba372bd/*-json.log]

```

## Edit #2:

After a deeper search, I found this question regarding the same topic:

> [Filebeat autodiscover for Kubernetes uses inconsistent log files path by default](https://discuss.elastic.co/t/filebeat-autodiscover-for-kubernetes-uses-inconsistent-log-files-path-by-default/279834)

I'm doing an additional dive to determine whether that issue has been resolved yet.

_Update:_ I haven't been able to find any indication that this has been resolved (or even that it was raised as an issue). Anybody know if it has?

Thanks.

---

<div class="post-metadata">

**Author:** ![DougR](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dougr/32/48095_2.png) [@DougR](https://discuss.elastic.co/u/DougR)\
**Post date:** [October 13, 2021, 1:59pm UTC](https://discuss.elastic.co/t/filebeat-7-13-4-kubernetes-1-20-hints-based-autodiscover/286421/2 "2021-10-13T13:59:47Z")

</div>

> [@DougR](#):
>
> We just upgraded our Kubernetes cluster to 1.20 (current version of filebeat is 7.13.4). Of course, this means that Kubernetes logs are no longer in the same place they were under 1.19, and instead are in the following location:

I've validated that this still appears to be the case in 7.15.0. I was unable to find a ticket opened by the user in the linked-to issue, so I've opened one.

---

<div class="post-metadata">

**Author:** ![DougR](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dougr/32/48095_2.png) [@DougR](https://discuss.elastic.co/u/DougR)\
**Post date:** [October 13, 2021, 2:40pm UTC](https://discuss.elastic.co/t/filebeat-7-13-4-kubernetes-1-20-hints-based-autodiscover/286421/3 "2021-10-13T14:40:54Z")

</div>

Under 7.15.0, specifying the path under `default_config` forces the use of the correct path:

```auto
- type: 'kubernetes'
  hints:
    enabled: true
    default_config:
      enabled: false
      type: 'container'
      paths:
        - '/var/log/containers/*-${data.container.id}.log'
      cri:
        force: true
        parse_flags: true
  processors:
    - add_kubernetes_metadata: ~

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 10, 2021, 4:41pm UTC](https://discuss.elastic.co/t/filebeat-7-13-4-kubernetes-1-20-hints-based-autodiscover/286421/4 "2021-11-10T16:41:19Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.