# Filebeat autodiscoverkubernetes

**URL:** <https://discuss.elastic.co/t/filebeat-autodiscoverkubernetes/161967>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [December 24, 2018, 4:09am UTC](https://discuss.elastic.co/t/filebeat-autodiscoverkubernetes/161967 "2018-12-24T04:09:57Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![icoolchn](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/icoolchn/32/45675_2.png) [@icoolchn](https://discuss.elastic.co/u/icoolchn)\
**Post date:** [December 24, 2018, 4:09am UTC](https://discuss.elastic.co/t/filebeat-autodiscoverkubernetes/161967/1 "2018-12-24T04:09:57Z")

</div>

reference [Filebeat kubernetes autodiscover Multiple conditions](https://discuss.elastic.co/t/filebeat-kubernetes-autodiscover-multiple-conditions/161145)

The problem is When the condition has “kubernetes.labels.log-index” ，fields:log\_topic: 'labels-{data.kubernetes.labels.log-index}', otherwise fields: log\_topic: 'aip-{data.kubernetes.namespace}-${data.kubernetes.pod.name}'  
The default condition not.equals.kubernetes.container.name: "filebeat" 。

Currently in use appenders ，But error is ERROR instance/beat.go:691 Exiting: unknown autodiscover appender config  
Reference : [Filebeat autodiscovery appenders](https://discuss.elastic.co/t/filebeat-autodiscovery-appenders/142619/3) , But there are still ERROR instance/beat.go:691 Exiting: unknown

filebeat run kubernetes daemonset.  
filebeat docker image  
[docker.elastic.co/beats/filebeat:6.5.4](http://docker.elastic.co/beats/filebeat:6.5.4)  
or  
[docker.elastic.co/beats/filebeat-oss:6.5.3](http://docker.elastic.co/beats/filebeat-oss:6.5.3)

filebeat.yaml

```
  filebeat.autodiscover:
    providers:
      - type: kubernetes
        hints.enabled: true
        templates:
          - condition.and:
              - not.has_fields: ['kubernetes.labels.log-index']
              - not.equals.kubernetes.container.name: "filebeat"
            config:
              - type: docker
                containers.ids:
                  - "${data.kubernetes.container.id}"
                exclude_lines: ["^\\s+[\\-`('.|_]"] # drop asciiart lines
                fields:
                  log_topic: 'aip-${data.kubernetes.namespace}-${data.kubernetes.pod.name}'
        appenders:
          - type: config
            condition.and:                      
              - has_fields: ['kubernetes.labels.log-index']
              - not.equals.kubernetes.container.name: "filebeat"        
            config:
              fields:
                log_topic: 'labels-${data.kubernetes.labels.log-index}'
```

---

<div class="post-metadata">

**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\
**Post date:** [December 27, 2018, 2:13pm UTC](https://discuss.elastic.co/t/filebeat-autodiscoverkubernetes/161967/2 "2018-12-27T14:13:31Z")

</div>

This looks like a bug. To me it looks like the `config` appender is not compiled into filebeat. Please [open a bug report](https://github.com/elastic/beats/issues/new/choose)

---

<div class="post-metadata">

**Author:** ![icoolchn](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/icoolchn/32/45675_2.png) [@icoolchn](https://discuss.elastic.co/u/icoolchn)\
**Post date:** [December 28, 2018, 7:33am UTC](https://discuss.elastic.co/t/filebeat-autodiscoverkubernetes/161967/3 "2018-12-28T07:33:37Z")

</div>

@ [steffens](https://discuss.elastic.co/u/steffens)  
Has been submitted ，Thank you

> <https://github.com/elastic/beats/issues/9817>

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 25, 2019, 7:33am UTC](https://discuss.elastic.co/t/filebeat-autodiscoverkubernetes/161967/4 "2019-01-25T07:33:42Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.