# Filebeat not sending data to elasticsearch
**URL:** https://discuss.elastic.co/t/filebeat-not-sending-data-to-elasticsearch/338154
**Category:** Beats
**Tags:** filebeat
**Created:** [July 11, 2023, 7:56pm UTC](https://discuss.elastic.co/t/filebeat-not-sending-data-to-elasticsearch/338154 "2023-07-11T19:56:04Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@gigallo](https://discuss.elastic.co/u/gigallo)
#### Post date: [July 11, 2023, 7:56pm UTC](https://discuss.elastic.co/t/filebeat-not-sending-data-to-elasticsearch/338154/1 "2023-07-11T19:56:04Z")
Hi
've installed elasticsearch 8.5 and Kibana 8.5 in my kubernetes cluster simply applying the official helm file in the elastic repo. Now I'm trying to install filebeat with the following conf:
```auto
filebeat.inputs:
- type: container
paths:
- "/var/log/app.log"
processors:
- add_kubernetes_metadata:
host: ${NODE_NAME}
in_cluster: true
```
and
```auto
output.elasticsearch:
hosts: ['${ELASTICSEARCH_HOST:elasticsearch}:${ELASTICSEARCH_PORT:9200}']
username: ${ELASTICSEARCH_USERNAME}
password: ${ELASTICSEARCH_PASSWORD}
protocol: https
ssl.certificate_authorities: ["/usr/share/filebeat/certs/ca.crt"]
```
Our apps are writing logs in pod container under /var/log/app.log but it seems filebeat does not read the log or not send it to elasticsearch because no index are created in elastic.
How can I solve the problem? What am I doing wrong?
Thanks
---
### Author:  [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)
#### Post date: [July 11, 2023, 8:34pm UTC](https://discuss.elastic.co/t/filebeat-not-sending-data-to-elasticsearch/338154/2 "2023-07-11T20:34:34Z")
Is your filebeat running? What do you have in your filebeat logs?
> [@gigallo](#):
>
> ```auto
> filebeat.inputs:
> - type: container
> paths:
> - "/var/log/app.log"
> processors:
> - add_kubernetes_metadata:
> host: ${NODE_NAME}
> in_cluster: true
>
> ```
If your `filebeat.yml` looks like this, then it looks wrong, the indentation for the `processors` key is wrong, `processors` should be on the same column as `filebeat.inputs`.
---
### Author:  [@gigallo](https://discuss.elastic.co/u/gigallo)
#### Post date: [July 11, 2023, 9:46pm UTC](https://discuss.elastic.co/t/filebeat-not-sending-data-to-elasticsearch/338154/3 "2023-07-11T21:46:02Z")
Filebeat is running and there are 12 pods running.
Sorry, but I made a mistake copying and pasting my file.
This is the right one:
```auto
filebeat.yml: |-
filebeat.inputs:
- type: container
paths:
- "/var/log/*.log"
json.keys_under_root: true
json.overwrite_keys: true
json.add_error_key: true
json.expand_keys: true
processors:
- add_cloud_metadata:
- add_host_metadata:
- add_kubernetes_metadata:
host: ${NODE_NAME}
in_cluster: true
```
In filebeat logs I have a lot of errors saying:
```auto
{"log.level":"error","@timestamp":"2023-07-11T21:40:18.493Z","log.logger":"reader_docker_json","log.origin":{"file.name":"readjson/docker_json.go","file.line":231},"message":"Parse line error: parsing CRI timestamp: parsing time \"2023/06/16\" as \"2006-01-02T15:04:05.999999999Z07:00\": cannot parse \"/06/16\" as \"-\"","service.name":"filebeat","ecs.version":"1.6.0"}
```
No other errors are found (for example reaching elasticsearch master or something else)
Thanks
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 8, 2023, 11:46pm UTC](https://discuss.elastic.co/t/filebeat-not-sending-data-to-elasticsearch/338154/4 "2023-08-08T23:46:36Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.