# Filebit does not see some of the containers on the host in the kubernetes

**URL:** <https://discuss.elastic.co/t/filebit-does-not-see-some-of-the-containers-on-the-host-in-the-kubernetes/185151>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [June 11, 2019, 9:58am UTC](https://discuss.elastic.co/t/filebit-does-not-see-some-of-the-containers-on-the-host-in-the-kubernetes/185151 "2019-06-11T09:58:58Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![pastukhov](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pastukhov/32/37471_2.png) [@pastukhov](https://discuss.elastic.co/u/pastukhov)\
**Post date:** [June 11, 2019, 9:58am UTC](https://discuss.elastic.co/t/filebit-does-not-see-some-of-the-containers-on-the-host-in-the-kubernetes/185151/1 "2019-06-11T09:58:58Z")

</div>

Good day!

Today I found that filebit does not collect logs from a part of the containers in my cluster

My config:

```auto
    filebeat.config:
      modules:
        path: ${path.config}/modules.d/*.yml
        reload.enabled: false
      inputs:
        path: ${path.config}/prospectors.d/*.yml
        reload.enabled: false
    filebeat.inputs:
    - enabled: true
      paths:
      - /var/log/*.log
      - /var/log/messages
      - /var/log/syslog
      type: log
    - containers.ids:
      - "*"
      multiline:
        match: after
        negate: false
        pattern: '^[[:space:]]|^Caused by:'
      processors:
      - add_kubernetes_metadata:
          in_cluster: true
      - drop_event:
          when:
            or:
            - equals:
                kubernetes.container.name: filebeat
            - equals:
                kubernetes.container.name: logstash
      type: docker

```

Filebeat version: 6.7.0

Number of containers harvested:

```auto
    kubectl logs filebeat-zw7xr -c filebeat | grep Harvester | grep docker |wc -l
    12

```

Number of containers started:

```auto
    docker ps | wc -l
    45

```

Number of logfiles:

```auto
    find /var/lib/docker/containers -name *json.log | wc -l
    47

```

Can anyone help?

---

<div class="post-metadata">

**Author:** ![exekias](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/exekias/32/28718_2.png) [@exekias](https://discuss.elastic.co/u/exekias)\
**Post date:** [June 13, 2019, 8:38am UTC](https://discuss.elastic.co/t/filebit-does-not-see-some-of-the-containers-on-the-host-in-the-kubernetes/185151/2 "2019-06-13T08:38:17Z")

</div>

Hi @pastukhov,

`docker` does detection based on file listing, so I'm wondering what's going on here, could it be that Filebeat doesn't have permission to read these files? You could also enable debug mode, by passing `-d '*'` param, to see more details.

Best regards

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 11, 2019, 8:38am UTC](https://discuss.elastic.co/t/filebit-does-not-see-some-of-the-containers-on-the-host-in-the-kubernetes/185151/3 "2019-07-11T08:38:17Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.