# Filebeat autodiscovery appenders

**URL:** <https://discuss.elastic.co/t/filebeat-autodiscovery-appenders/142619>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [August 1, 2018, 4:07pm UTC](https://discuss.elastic.co/t/filebeat-autodiscovery-appenders/142619 "2018-08-01T16:07:30Z")\
**Posts on this page:** 10\
**Page:** 1

<div class="post-metadata">

**Author:** ![Nick\_Carn](https://avatars.discourse-cdn.com/v4/letter/n/f6c823/32.png) [@Nick\_Carn](https://discuss.elastic.co/u/Nick_Carn)\
**Post date:** [August 1, 2018, 4:07pm UTC](https://discuss.elastic.co/t/filebeat-autodiscovery-appenders/142619/1 "2018-08-01T16:07:30Z")

</div>

Hi there,

I am using filebeat with autodiscovery and would like to use appenders. However the appender config is not being applied. This is my filebeat.yml config.

```
filebeat.autodiscover:
  providers:
    - type: kubernetes
      templates:
        - condition:
            equals:
              kubernetes.namespace: default
          config:
            - type: docker
              containers.ids:
                - "${data.kubernetes.container.id}"
  appenders:
    - type: config
      condition.equals:
        kubernetes.container.name: "spring-boot"
      config:
        tags: ["spring"]

output.logstash:
  hosts: ["192.168.16.119:5044"]

```

Thanks for any help.  
Nick

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [August 1, 2018, 4:48pm UTC](https://discuss.elastic.co/t/filebeat-autodiscovery-appenders/142619/2 "2018-08-01T16:48:33Z")

</div>

It appears that the indentation is wrong, `appenders` should be at the same level as `templates`.

So the docs at [https://www.elastic.co/guide/en/beats/filebeat/6.3/configuration-autodiscover-advanced.html#\_appenders](https://www.elastic.co/guide/en/beats/filebeat/6.3/configuration-autodiscover-advanced.html#_appenders) are also wrong. Could you please open a [new Github issue](https://github.com/elastic/beats/issues/new) for the documentation.

---

<div class="post-metadata">

**Author:** ![Nick\_Carn](https://avatars.discourse-cdn.com/v4/letter/n/f6c823/32.png) [@Nick\_Carn](https://discuss.elastic.co/u/Nick_Carn)\
**Post date:** [August 1, 2018, 5:14pm UTC](https://discuss.elastic.co/t/filebeat-autodiscovery-appenders/142619/3 "2018-08-01T17:14:29Z")

</div>

I will. Thanks for your help.

---

<div class="post-metadata">

**Author:** ![Nick\_Carn](https://avatars.discourse-cdn.com/v4/letter/n/f6c823/32.png) [@Nick\_Carn](https://discuss.elastic.co/u/Nick_Carn)\
**Post date:** [August 2, 2018, 9:35am UTC](https://discuss.elastic.co/t/filebeat-autodiscovery-appenders/142619/4 "2018-08-02T09:35:18Z")

</div>

Hello,

Now i get this error:

`2018-08-02T09:31:12.703Z	ERROR	instance/beat.go:691	Exiting: unknown autodiscover appender config`

With the following config.

```
filebeat.autodiscover:
  providers:
    - type: kubernetes
      templates:
        - condition:
            equals:
              kubernetes.namespace: default
          config:
            - type: docker
              containers.ids:
                - "${data.kubernetes.container.id}"
      appenders:
        - type: config
          condition.equals:
              kubernetes.container.name: "spring-boot"
          config:
            tags: ["spring"]

output.logstash:
  hosts: ["192.168.16.119:5044"]

```

Any ideas?

Thank you,  
Nick

---

<div class="post-metadata">

**Author:** ![exekias](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/exekias/32/28718_2.png) [@exekias](https://discuss.elastic.co/u/exekias)\
**Post date:** [August 2, 2018, 1:59pm UTC](https://discuss.elastic.co/t/filebeat-autodiscovery-appenders/142619/5 "2018-08-02T13:59:03Z")

</div>

Hi @Nick_Carn,

What version of Filebeat are you using? `config` appender was introduced in version 6.3

---

<div class="post-metadata">

**Author:** ![Nick\_Carn](https://avatars.discourse-cdn.com/v4/letter/n/f6c823/32.png) [@Nick\_Carn](https://discuss.elastic.co/u/Nick_Carn)\
**Post date:** [August 2, 2018, 2:24pm UTC](https://discuss.elastic.co/t/filebeat-autodiscovery-appenders/142619/6 "2018-08-02T14:24:51Z")

</div>

Hi @exekias,

I am using 6.3.1

root@vpm-filebeat-w4k8h:/# /opt/filebeat/filebeat version  
filebeat version 6.3.1 (amd64), libbeat 6.3.1 [ed42bb85e72ae58cc09748dc1825159713e0ffd4 built 2018-06-29 21:09:35 +0000 UTC]

---

<div class="post-metadata">

**Author:** ![exekias](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/exekias/32/28718_2.png) [@exekias](https://discuss.elastic.co/u/exekias)\
**Post date:** [August 2, 2018, 2:32pm UTC](https://discuss.elastic.co/t/filebeat-autodiscovery-appenders/142619/7 "2018-08-02T14:32:33Z")

</div>

This looks like a bug, could you please open a new bug report? I will have a look to it: [https://github.com/elastic/beats/issues](https://github.com/elastic/beats/issues)

---

<div class="post-metadata">

**Author:** ![exekias](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/exekias/32/28718_2.png) [@exekias](https://discuss.elastic.co/u/exekias)\
**Post date:** [August 2, 2018, 2:41pm UTC](https://discuss.elastic.co/t/filebeat-autodiscovery-appenders/142619/8 "2018-08-02T14:41:57Z")

</div>

Sorry for the inconvenience, I went ahead and opened a fix for this: [https://github.com/elastic/beats/pull/7846](https://github.com/elastic/beats/pull/7846)

---

<div class="post-metadata">

**Author:** ![Nick\_Carn](https://avatars.discourse-cdn.com/v4/letter/n/f6c823/32.png) [@Nick\_Carn](https://discuss.elastic.co/u/Nick_Carn)\
**Post date:** [August 2, 2018, 5:09pm UTC](https://discuss.elastic.co/t/filebeat-autodiscovery-appenders/142619/9 "2018-08-02T17:09:45Z")

</div>

Cool thanks

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 30, 2018, 5:22pm UTC](https://discuss.elastic.co/t/filebeat-autodiscovery-appenders/142619/10 "2018-08-30T17:22:22Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
