# Filebeat Autodiscover template condition is not working

**URL:** <https://discuss.elastic.co/t/filebeat-autodiscover-template-condition-is-not-working/288289>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [November 3, 2021, 7:21am UTC](https://discuss.elastic.co/t/filebeat-autodiscover-template-condition-is-not-working/288289 "2021-11-03T07:21:00Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![vijayebpzr](https://avatars.discourse-cdn.com/v4/letter/v/a9adbd/32.png) [@vijayebpzr](https://discuss.elastic.co/u/vijayebpzr)\
**Post date:** [November 3, 2021, 7:21am UTC](https://discuss.elastic.co/t/filebeat-autodiscover-template-condition-is-not-working/288289/1 "2021-11-03T07:21:00Z")

</div>

I am trying to get logs from specific container in a kubernetes cluster using filebeat auto discover feature. But the condition is not working. IS there a way to apply the filter condition?

```auto
filebeat.autodiscover:

        providers:

          - type: kubernetes

            node: ${NODE_NAME}

            hints.enabled: true

            hints.default_config:

              type: container

              paths:

                - /var/log/containers/*${data.kubernetes.container.id}.log            

            templates: 

              - condition:

                  equals:

                    kubernetes.container.image: "elasticsearch"

      filebeat.modules:

        - module: elasticsearch

      filebeat.config.modules:

        path: ${path.config}/modules.d/*.yml

        reload.enabled: false

      output.elasticsearch:

        hosts: xxxx

        username: 'xxxx'

        password: 'xxxxx'

        protocol: https

        ssl.verification_mode: certificate

        ssl.certificate_authorities: ["xxx"]

        ssl.certificate: "xxxx" 

        ssl.key: "xxxx"

```

However I am still getting logs from all containers. How can i make the template condition work? I tried with other fields like kubernetes.container.name , kubernetes.labels.release etc and nothing is working.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 1, 2021, 9:21am UTC](https://discuss.elastic.co/t/filebeat-autodiscover-template-condition-is-not-working/288289/2 "2021-12-01T09:21:53Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.