# Filebeat autodiscover advanced pod log shipping with container specific actions **URL:** \ **Category:** Beats\ **Tags:** filebeat\ **Created:** [August 10, 2018, 7:50am UTC](https://discuss.elastic.co/t/filebeat-autodiscover-advanced-pod-log-shipping-with-container-specific-actions/143820 "2018-08-10T07:50:59Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![havlan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/havlan/32/32379_2.png) [@havlan](https://discuss.elastic.co/u/havlan)\ **Post date:** [August 10, 2018, 7:50am UTC](https://discuss.elastic.co/t/filebeat-autodiscover-advanced-pod-log-shipping-with-container-specific-actions/143820/1 "2018-08-10T07:50:59Z")
Hi! I know autodiscover for Kubernetes/Docker is quite new. In a pod context where a pod has several containers, is it possible to specify a sidecar configuration from kubernetes metadata in terms of achieving logging with a more specific type than docker? =) I'm aware that a possible workaround is to use Docker labels with docker autodiscover, but the goal is to do this from a kubernetes deployment manifest. Example idea in a kubernetes deployment: ```auto metadata: labels: ... annotations: log-service: spring log-type: json log-token: XXXXXXXXXXXX sidecars: - redis: log-service: redis log-type: log log-token: XXXXXXXXXXXX log-module: redis - nginx log-service: nginx log-type: log log-token: XXXXXXXXXXXX log-module: nginx ``` Is this possible? Or are pods limited/restricted to using the same output type for all containers in the pod? Does anyone have different ideas about how to approach this use case? Edit: Would this case be solvable with annotations and [raw input](https://www.elastic.co/guide/en/beats/filebeat/master/configuration-autodiscover-hints.html#_literal_co_elastic_logs_raw_literal)? ---
**Author:** ![jsoriano](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jsoriano/32/27920_2.png) [@jsoriano](https://discuss.elastic.co/u/jsoriano)\ **Post date:** [August 10, 2018, 2:24pm UTC](https://discuss.elastic.co/t/filebeat-autodiscover-advanced-pod-log-shipping-with-container-specific-actions/143820/2 "2018-08-10T14:24:35Z")
Hi @havlan, You can have a different configuration for each container in the pod using hint-based autodiscover. Look at the section about [multiple containers](https://www.elastic.co/guide/en/beats/filebeat/6.3/configuration-autodiscover-hints.html#_multiple_containers) in the documentation. For your case I think you could have something like this (not tested 🙂 ): ```auto annotations: co.elastic.logs.nginx/module: nginx co.elastic.logs.nginx/fileset.stdout: access co.elastic.logs.nginx/fileset.stderr: error co.elastic.logs.redis/module: redis ... ``` (Being `redis` and `nginx` the name of the containers in the pod) ---
**Author:** ![havlan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/havlan/32/32379_2.png) [@havlan](https://discuss.elastic.co/u/havlan)\ **Post date:** [August 13, 2018, 10:39am UTC](https://discuss.elastic.co/t/filebeat-autodiscover-advanced-pod-log-shipping-with-container-specific-actions/143820/3 "2018-08-13T10:39:48Z")
Do you have an idea on how this will interact with processors or a fields entry? I would still need to extract data from metadata labels, would this require using the `raw` annotation field? (I either need to rename kubernetes labels or add those labels as fields for further processing) ---
**Author:** ![jsoriano](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jsoriano/32/27920_2.png) [@jsoriano](https://discuss.elastic.co/u/jsoriano)\ **Post date:** [August 14, 2018, 11:52am UTC](https://discuss.elastic.co/t/filebeat-autodiscover-advanced-pod-log-shipping-with-container-specific-actions/143820/4 "2018-08-14T11:52:50Z")
In filebeat there are two places where you can put `processors`, at the top-level configuration and at the input configuration. Processors at the top-level configuration are applied to all events, it doesn't matter if they where collected by an input configured from autodiscover hints. If they are defined in the input configuration, then they are only applied to events collected from this input. On beats 6.4 there will be the possibility of configuring [processors](https://www.elastic.co/guide/en/beats/filebeat/6.4/configuration-autodiscover-hints.html#_literal_co_elastic_logs_processors_literal) using hints too. And if you need to define an input with something not supported by hints (like `fields` at the moment) there will also be the option of using the [`raw`](https://www.elastic.co/guide/en/beats/filebeat/6.4/configuration-autodiscover-hints.html#_literal_co_elastic_logs_raw_literal) annotation to define any configuration. ---
**Author:** ![havlan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/havlan/32/32379_2.png) [@havlan](https://discuss.elastic.co/u/havlan)\ **Post date:** [August 22, 2018, 10:05am UTC](https://discuss.elastic.co/t/filebeat-autodiscover-advanced-pod-log-shipping-with-container-specific-actions/143820/5 "2018-08-22T10:05:00Z")
Alright, thanks for clarifying. I think a global processor (rename) would be the solution in our case. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [September 19, 2018, 10:05am UTC](https://discuss.elastic.co/t/filebeat-autodiscover-advanced-pod-log-shipping-with-container-specific-actions/143820/6 "2018-09-19T10:05:02Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.