I can't see logs when I upgrade kubernetes filebeat 6.0 to 6.6.1

[irraz]

Hi there,

I tried upgrade filebeat 6.0 to 6.6.1 in kubernetes:

https://raw.githubusercontent.com/elastic/beats/6.0/deploy/kubernetes/filebeat-kubernetes.yaml

to

https://raw.githubusercontent.com/elastic/beats/6.6/deploy/kubernetes/filebeat-kubernetes.yaml

The first change that I notice, while 6.0 use:

---
apiVersion: v1
kind: ConfigMap
metadata:
  name: filebeat-prospectors
  namespace: kube-system
  labels:
    k8s-app: filebeat
    kubernetes.io/cluster-service: "true"
data:
  kubernetes.yml: |-
    - type: log
      paths:
        - /var/lib/docker/containers/*/*.log
      json.message_key: log
      json.keys_under_root: true
      processors:
        - add_kubernetes_metadata:
            in_cluster: true
            namespace: ${POD_NAMESPACE}

6.6 use file-inputs:

---
apiVersion: v1
kind: ConfigMap
metadata:
  name: filebeat-inputs
  namespace: kube-system
  labels:
    k8s-app: filebeat
data:
  kubernetes.yml: |-
    - type: docker
      containers.ids:
      - "*"
      processors:
        - add_kubernetes_metadata:
            in_cluster: true

This change cause in my kibana logs show:

{
  "file": {
    "path": "/var/lib/docker/containers/fb1af0700e6adba375e1e702ad4d4c4a8cdc75eaafca438dd7db18a5fe38e8e6/fb1af0700e6adba375e1e702ad4d4c4a8cdc75eaafca438dd7db18a5fe38e8e6-json.log"
  }
}

While in 6.0 they were:

x.x.x.x - - [08/Mar/2019:11:24:07 +0000] "GET /config.json HTTP/1.1" 200 610 "https://xxxx" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.98 Safari/537.36" "xxxx"

Is it an error or can I change the config of the file type log in the data input to the docker?

Regards,

[pierhugues (Pier-Hugues Pellerin)]

We did rename prospector to inputs for futures version, but If you want to keep the old name I don't see a problem with that.

[irraz]

Thanks for the reply,

I do not have the problem with the name, but now with the version change it shows me the path of the Docker log, not its content.

any ideas?

[irraz]

I solve, now logs show in "message" field. In old versions show in "log" field.

Thanks