Filebeat file path not working

Elastic Stack Beats
1

I have filebeat deployed through ECK on my Kubernetes cluster. I want to read the logs from a specific pod whose log file name is something like this dev-be-svc-logistic-8c9bfbd85-qs6ng_smartbox-dev_dev-be-svc-logistic-4b3a4b4345fbf2c6f44545fdbcdd49a1c687512d08fa94c4f0d4c75f5dea06e9.log and the pod name is something like this dev-be-svc-logistic-8c9bfbd85-qs6ng.
In the filebeat deployment file, I have given the path like this

- type: container
      paths:
      - /var/log/containers/dev-be-svc-logistic-*.log

I have added the path like this because when pods go down and are created again, then this file name may change a little bit.
Issue I'm facing is that no logs are being read and written to kafka topic.
Is there anything I'm doing wrong here?

2

Hi,

Could you share the whole filebeat configuration?

Does filebeat has access to this file? Is this directory mounted in the filebeat container as a volume?

Could you check Filebeat logs in case you find some error there?

In any case, to discover the paths for logs of pods, you can also use autodiscover, that gives you higher-level configuration options for this purpouse, check docs here: Autodiscover | Filebeat Reference [8.3] | Elastic

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.