# I can't see logs when I upgrade kubernetes filebeat 6.0 to 6.6.1

**URL:** https://discuss.elastic.co/t/i-cant-see-logs-when-i-upgrade-kubernetes-filebeat-6-0-to-6-6-1/171480
**Category:** Beats
**Tags:** filebeat
**Created:** [March 8, 2019, 11:26am UTC](https://discuss.elastic.co/t/i-cant-see-logs-when-i-upgrade-kubernetes-filebeat-6-0-to-6-6-1/171480 "2019-03-08T11:26:02Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![irraz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/irraz/32/41710_2.png) [@irraz](https://discuss.elastic.co/u/irraz)
#### Post date: [March 8, 2019, 11:26am UTC](https://discuss.elastic.co/t/i-cant-see-logs-when-i-upgrade-kubernetes-filebeat-6-0-to-6-6-1/171480/1 "2019-03-08T11:26:02Z")

</div>

Hi there,

I tried upgrade filebeat 6.0 to 6.6.1 in kubernetes:

[https://raw.githubusercontent.com/elastic/beats/6.0/deploy/kubernetes/filebeat-kubernetes.yaml](https://raw.githubusercontent.com/elastic/beats/6.0/deploy/kubernetes/filebeat-kubernetes.yaml)

to

[https://raw.githubusercontent.com/elastic/beats/6.6/deploy/kubernetes/filebeat-kubernetes.yaml](https://raw.githubusercontent.com/elastic/beats/6.6/deploy/kubernetes/filebeat-kubernetes.yaml)

The first change that I notice, while 6.0 use:

```
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: filebeat-prospectors
  namespace: kube-system
  labels:
    k8s-app: filebeat
    kubernetes.io/cluster-service: "true"
data:
  kubernetes.yml: |-
    - type: log
      paths:
        - /var/lib/docker/containers/*/*.log
      json.message_key: log
      json.keys_under_root: true
      processors:
        - add_kubernetes_metadata:
            in_cluster: true
            namespace: ${POD_NAMESPACE}

```

6.6 use file-inputs:

```
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: filebeat-inputs
  namespace: kube-system
  labels:
    k8s-app: filebeat
data:
  kubernetes.yml: |-
    - type: docker
      containers.ids:
      - "*"
      processors:
        - add_kubernetes_metadata:
            in_cluster: true

```

This change cause in my kibana logs show:

```
{
  "file": {
    "path": "/var/lib/docker/containers/fb1af0700e6adba375e1e702ad4d4c4a8cdc75eaafca438dd7db18a5fe38e8e6/fb1af0700e6adba375e1e702ad4d4c4a8cdc75eaafca438dd7db18a5fe38e8e6-json.log"
  }
}

```

While in 6.0 they were:

`x.x.x.x - - [08/Mar/2019:11:24:07 +0000] "GET /config.json HTTP/1.1" 200 610 "https://xxxx" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.98 Safari/537.36" "xxxx"`

Is it an error or can I change the config of the file type log in the data input to the docker?

Regards,

---

<div class="post-metadata">

### Author: ![pierhugues](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pierhugues/32/48383_2.png) [@pierhugues](https://discuss.elastic.co/u/pierhugues)
#### Post date: [March 8, 2019, 4:56pm UTC](https://discuss.elastic.co/t/i-cant-see-logs-when-i-upgrade-kubernetes-filebeat-6-0-to-6-6-1/171480/2 "2019-03-08T16:56:01Z")

</div>

We did rename `prospector` to `inputs` for futures version, but If you want to keep the old name I don't see a problem with that.

---

<div class="post-metadata">

### Author: ![irraz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/irraz/32/41710_2.png) [@irraz](https://discuss.elastic.co/u/irraz)
#### Post date: [March 8, 2019, 8:39pm UTC](https://discuss.elastic.co/t/i-cant-see-logs-when-i-upgrade-kubernetes-filebeat-6-0-to-6-6-1/171480/3 "2019-03-08T20:39:43Z")

</div>

Thanks for the reply,

I do not have the problem with the name, but now with the version change it shows me the path of the Docker log, not its content.

any ideas?

---

<div class="post-metadata">

### Author: ![irraz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/irraz/32/41710_2.png) [@irraz](https://discuss.elastic.co/u/irraz)
#### Post date: [March 9, 2019, 4:04pm UTC](https://discuss.elastic.co/t/i-cant-see-logs-when-i-upgrade-kubernetes-filebeat-6-0-to-6-6-1/171480/4 "2019-03-09T16:04:11Z")

</div>

I solve, now logs show in "message" field. In old versions show in "log" field.

Thanks

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 6, 2019, 4:13pm UTC](https://discuss.elastic.co/t/i-cant-see-logs-when-i-upgrade-kubernetes-filebeat-6-0-to-6-6-1/171480/5 "2019-04-06T16:13:40Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
