# Filebeat not picking up /var/log/containers/\*.log k8s

**URL:** <https://discuss.elastic.co/t/filebeat-not-picking-up-var-log-containers-log-k8s/250576>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [September 30, 2020, 11:25pm UTC](https://discuss.elastic.co/t/filebeat-not-picking-up-var-log-containers-log-k8s/250576 "2020-09-30T23:25:42Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![dsuma](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dsuma/32/76487_2.png) [@dsuma](https://discuss.elastic.co/u/dsuma)\
**Post date:** [September 30, 2020, 11:25pm UTC](https://discuss.elastic.co/t/filebeat-not-picking-up-var-log-containers-log-k8s/250576/1 "2020-09-30T23:25:42Z")

</div>

I have filebeats deployed onto my kube cluster through the elastic helm chart.

The pod is privileged. Filebeats is picking up the new log that I create on the node. `touch /var/log/containers/mylog.log` and then I add stuff to it, and I see it in kibana. Which means that the filebeats -\> kafka -\> logstash -\> elasticsearch -\> kibana works. But I cannot pick up the other logs in that dir.

The logs in /var/log/containers/ are all symlinks.

Here is my config:

```
    filebeat.yml: |
    filebeat.inputs:
      - type: container
        enabled: true
        symlinks: true
        paths:
          - /var/log/containers/*.log
        processors:
        - add_kubernetes_metadata:
            host: ${NODE_NAME}
            matchers:
            - logs_path:
                logs_path: "/var/log/containers/"
      - type: log
        enabled: true
        symlinks: true
        paths:
          - /var/log/containers/*.log
        processors:
        - add_kubernetes_metadata:
            host: ${NODE_NAME}
            matchers:
            - logs_path:
                logs_path: "/var/log/containers/"
    output.kafka:
       enabled: true
       hosts: ["kafka.logging.svc.cluster.local:9092"]
       topic: "filebeat"
       codec.json:
          pretty: false
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 29, 2020, 1:26am UTC](https://discuss.elastic.co/t/filebeat-not-picking-up-var-log-containers-log-k8s/250576/2 "2020-10-29T01:26:06Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.