# How activate module to parser envoy logs

**URL:** <https://discuss.elastic.co/t/how-activate-module-to-parser-envoy-logs/233337>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [May 19, 2020, 2:15pm UTC](https://discuss.elastic.co/t/how-activate-module-to-parser-envoy-logs/233337 "2020-05-19T14:15:18Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![David\_Oceans](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/david_oceans/32/51452_2.png) [@David\_Oceans](https://discuss.elastic.co/u/David_Oceans)\
**Post date:** [May 19, 2020, 2:15pm UTC](https://discuss.elastic.co/t/how-activate-module-to-parser-envoy-logs/233337/1 "2020-05-19T14:15:18Z")

</div>

Hi!

I found this page about envoy module but there isn't instructions to configure on Kubernetes installation.

[https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-envoyproxy.html](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-envoyproxy.html)

My **filebeat version is 7.0.0**

Should be like that?

```auto
- module: envoyproxy

```

But I'm using autodiscovery way, I don't know if I can use too

```auto
filebeat.config:

```

This is my configuration.

```auto
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: filebeat-config
  namespace: logging
  labels:
    k8s-app: filebeat
data:
  filebeat.yml: |-
    filebeat.autodiscover:
      providers:
        - type: kubernetes
          node: ${NODE_NAME}
          hints.enabled: true
          hints.default_config:
            type: container
            paths:
              - /var/log/containers/*${data.kubernetes.container.id}.log
            multiline.pattern: '^[[:space:]]+(at|\.{3})\b|^Caused by:'
            multiline.negate: false
            multiline.match: after
    processors:
      - add_cloud_metadata:
      - add_host_metadata:
      - decode_json_fields:
          fields: ["message"]
          target: "custom"
          overwrite_keys: true          
      - add_fields:
          target: ''
          fields:
            gkeclustername: xxx-core-stage

    cloud.id: ${ELASTIC_CLOUD_ID}
    cloud.auth: ${ELASTIC_CLOUD_AUTH}

    setup.ilm.rollover_alias: "${INDEX_NAME_CLUSTER}"

    output.elasticsearch:
      hosts: ['${ELASTICSEARCH_HOST:elasticsearch}:${ELASTICSEARCH_PORT:9200}']
      username: ${ELASTICSEARCH_USERNAME}
      password: ${ELASTICSEARCH_PASSWORD}

```

How should I add that module to my configuration?

By the other hand, this are in the right place? do you see it well?

```auto
            type: container
            paths:
              - /var/log/containers/*${data.kubernetes.container.id}.log
            multiline.pattern: '^[[:space:]]+(at|\.{3})\b|^Caused by:'
            multiline.negate: false
            multiline.match: after

```

Thank you very much

---

<div class="post-metadata">

**Author:** ![David\_Oceans](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/david_oceans/32/51452_2.png) [@David\_Oceans](https://discuss.elastic.co/u/David_Oceans)\
**Post date:** [May 21, 2020, 1:35pm UTC](https://discuss.elastic.co/t/how-activate-module-to-parser-envoy-logs/233337/2 "2020-05-21T13:35:08Z")

</div>

Any suggestion please?

Thank you very much

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 18, 2020, 1:35pm UTC](https://discuss.elastic.co/t/how-activate-module-to-parser-envoy-logs/233337/3 "2020-06-18T13:35:09Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.