# Filebeat log path on Kubernetes

**URL:** <https://discuss.elastic.co/t/filebeat-log-path-on-kubernetes/217891>\
**Category:** Beats\
**Tags:** docker, filebeat\
**Created:** [February 4, 2020, 11:37pm UTC](https://discuss.elastic.co/t/filebeat-log-path-on-kubernetes/217891 "2020-02-04T23:37:44Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Matt\_Kirkevold](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/matt_kirkevold/32/61801_2.png) [@Matt\_Kirkevold](https://discuss.elastic.co/u/Matt_Kirkevold)\
**Post date:** [February 4, 2020, 11:37pm UTC](https://discuss.elastic.co/t/filebeat-log-path-on-kubernetes/217891/1 "2020-02-04T23:37:44Z")

</div>

I am using the filebeat on kubernetes with autodiscover. In the [default filebeat-config configmap](https://raw.githubusercontent.com/elastic/beats/7.5/deploy/kubernetes/filebeat-kubernetes.yaml) the input path is /var/log/containers/\*${data.kubernetes.container.id}.log. In the [Running Filebeat on Kubernetes](https://www.elastic.co/guide/en/beats/filebeat/current/running-on-kubernetes.html#running-on-kubernetes) documentation it references the " Docker logs host folder ( `/var/lib/docker/containers` )".

My question is which is ultimately correct? Yes the /var/log/containers/\*{data.kubernetes.container.id}.log is a link to /var/lib/docker/containers but should the ConfigMap point directly to /var/lib/docker/containers with something like /var/lib/docker/containers/{data.kubernetes.container.id}/${data.kubernetes.container.id}.log\* to ensure we capture the end of logs that roll where those are not visible via the link file in the default ConfigMap? How does filebeat handle kubernetes container log rolls?

Thanks for any insight on this in advance.

-Matt

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 3, 2020, 11:37pm UTC](https://discuss.elastic.co/t/filebeat-log-path-on-kubernetes/217891/2 "2020-03-03T23:37:50Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.