# Filebeat inside Kubernetes setup questions

**URL:** <https://discuss.elastic.co/t/filebeat-inside-kubernetes-setup-questions/155101>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [November 2, 2018, 2:04am UTC](https://discuss.elastic.co/t/filebeat-inside-kubernetes-setup-questions/155101 "2018-11-02T02:04:56Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![rocketraman](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rocketraman/32/32342_2.png) [@rocketraman](https://discuss.elastic.co/u/rocketraman)\
**Post date:** [November 2, 2018, 2:04am UTC](https://discuss.elastic.co/t/filebeat-inside-kubernetes-setup-questions/155101/1 "2018-11-02T02:04:56Z")

</div>

I'm trying to use hints-based autodiscover with Filebeat 6.4.2 inside Kubernetes.

The basic setup is working (through some trials and tribulations noted in earlier messages in this forum). However, now I'm trying to enable hints-based parsing of various inputs.

The first I'm trying to setup as I figured it would be the easiest, is the kibana module. I've added the annotation `co.elastic.logs/module: kibana` on the kibana pods. I've confirmed filebeat is seeing this annotation -- it gets indexed in ES and is visible in the Kibana UI:

![image](https://us1.discourse-cdn.com/elastic/original/3X/1/f/1f57a151520d7c83482631b633dc5aeaf76a0f3c.png)

However, the `message` value is still the unparsed JSON -- and none of the structured values I would expect after passing through the kibana module:

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/b/3/b39a08a9e39ee6ce888b1c4a07adfe75af295cfe.png)

I've also tried the apache2 and elasticsearch modules, with similar no-op results.

The modules seem to be enabled inside filebeat:

```auto
2018-11-01T23:34:33.758Z	INFO	beater/filebeat.go:98	Enabled modules/filesets: kibana (log), kafka (log), (), apache2 (access, error), elasticsearch (slowlog, audit, deprecation, gc, server)

```

What am I missing? How do I enable this?

Regards,  
Raman

---

<div class="post-metadata">

**Author:** ![jsoriano](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jsoriano/32/27920_2.png) [@jsoriano](https://discuss.elastic.co/u/jsoriano)\
**Post date:** [November 3, 2018, 1:53pm UTC](https://discuss.elastic.co/t/filebeat-inside-kubernetes-setup-questions/155101/2 "2018-11-03T13:53:30Z")

</div>

Hi @rocketraman,

When using autodiscover you don't have to enable the modules in the filebeat configuration, they are enabled (or disabled) automatically as needed. You should be able to see something like `Autodiscover starting runner: kibana` in the logs when the kibana pod is detected.

Also, you need to enable hints-based autodiscover, this is not enabled by default. Check that you have `hints.enabled: true` in your kubernetes autodiscover configuration.

```auto
filebeat.autodiscover:
  providers:
    - type: kubernetes
      hints.enabled: true

```

For the pods configuration, notice that hints have to be placed in **annotations** , not in labels:

```auto
annotations:
  co.elastic.logs/module: kibana

```

Once all the configuration is fine, to continue investigating the problem check the logs. You should be able to see some messages about autodiscover only by enabling it, or some errors if it is not working. If you don't see anything you can enable autodiscover debug with `-d autodiscover`.

I hope this helps.

---

<div class="post-metadata">

**Author:** ![rocketraman](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rocketraman/32/32342_2.png) [@rocketraman](https://discuss.elastic.co/u/rocketraman)\
**Post date:** [November 5, 2018, 2:02pm UTC](https://discuss.elastic.co/t/filebeat-inside-kubernetes-setup-questions/155101/3 "2018-11-05T14:02:23Z")

</div>

> [@jsoriano](#):
>
> For the pods configuration, notice that hints have to be placed in **annotations** , not in labels:

Oops, this is what I had wrong. Thanks!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 3, 2018, 2:02pm UTC](https://discuss.elastic.co/t/filebeat-inside-kubernetes-setup-questions/155101/4 "2018-12-03T14:02:36Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.