# Kubernetes autodiscover not shipping logs to logstash

**URL:** <https://discuss.elastic.co/t/kubernetes-autodiscover-not-shipping-logs-to-logstash/142861>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [August 3, 2018, 7:51am UTC](https://discuss.elastic.co/t/kubernetes-autodiscover-not-shipping-logs-to-logstash/142861 "2018-08-03T07:51:12Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![havlan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/havlan/32/32379_2.png) [@havlan](https://discuss.elastic.co/u/havlan)\
**Post date:** [August 3, 2018, 7:51am UTC](https://discuss.elastic.co/t/kubernetes-autodiscover-not-shipping-logs-to-logstash/142861/1 "2018-08-03T07:51:13Z")

</div>

Hi, I'm having issues passing logs to logstash from filebeat.  
Filebeat version: 6.3.2

```auto
filebeat.yml: |-
    logging.level: ${LOG_LEVEL}
    filebeat.autodiscover:
      providers:
        - type: kubernetes
          in_cluster: true
          templates:
            - condition:
                or:
                  - equals:
                      kubernetes.namespace: development
                  - equals:
                      kubernetes.namespace: sqa
                  - equals:
                      kubernetes.namespace: test
                  - equals:
                      kubernetes.namespace: stage
              config:
                - type: docker
                  containers.ids:
                    - "${data.kubernetes.container.id}"
                  multiline.pattern: '^[[:space:]]'
                  multiline.negate: false
                  multiline.match: after

    output.logstash:
      hosts: ['${LOGSTASH_HOSTS}']

```

[kubernetes.yaml](https://gist.github.com/havlan/bcb6017e28c03881b7692798e0dbd780) based on [filebeat-autodiscover-kubernetes.yaml](https://gist.github.com/exekias/f8b0b300966fa148ac239ffaa70b5721)

The pipeline worked fine when i specified providers docker type, so I know data should pass to logstash.

I could use some help setting up correct debug flags in kubernetes manifest also!

Thanks.

---

<div class="post-metadata">

**Author:** ![havlan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/havlan/32/32379_2.png) [@havlan](https://discuss.elastic.co/u/havlan)\
**Post date:** [August 3, 2018, 8:46am UTC](https://discuss.elastic.co/t/kubernetes-autodiscover-not-shipping-logs-to-logstash/142861/2 "2018-08-03T08:46:36Z")

</div>

I suspect my mistake was not having processors entry in the same level as filebeat.autodiscover.

```auto
filebeat.yml: |-
    filebeat.autodiscover:
      providers:
        - type: kubernetes
          templates:
            - condition:
                or:
                  - equals:
                      kubernetes.namespace: kube-system
                  - equals:
                      kubernetes.namespace: default
              config:
                - type: docker
                  containers.ids:
                    - "${data.kubernetes.container.id}"
                  exclude_lines: ["^\\s+[\\-`('.|_]"] # drop asciiart lines
                  multiline.pattern: '^[[:space:]]'
                  multiline.negate: false
                  multiline.match: after
    processors:
      - add_kubernetes_metadata:
          in_cluster: true
    output.logstash:
      hosts: ['${LOGSTASH_HOSTS}']

```

---

<div class="post-metadata">

**Author:** ![kvch](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kvch/32/72058_2.png) [@kvch](https://discuss.elastic.co/u/kvch)\
**Post date:** [August 3, 2018, 9:39am UTC](https://discuss.elastic.co/t/kubernetes-autodiscover-not-shipping-logs-to-logstash/142861/3 "2018-08-03T09:39:39Z")

</div>

Adding `add_kubernetes_metadata` will not solve your problem. It adds metadata on kuberetes to your events. If you cannot read the input, there won't be any events to add metadata to.

You could try to change `equals` in the list of conditions to `contains`. Is that the part you have added recently, correct?

---

<div class="post-metadata">

**Author:** ![havlan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/havlan/32/32379_2.png) [@havlan](https://discuss.elastic.co/u/havlan)\
**Post date:** [August 3, 2018, 10:02am UTC](https://discuss.elastic.co/t/kubernetes-autodiscover-not-shipping-logs-to-logstash/142861/4 "2018-08-03T10:02:20Z")

</div>

Thanks for your feedback. I added processors and now events are being logged as desired. It works as I expect now. So my initial thought was that the processors entry was needed. I don't know if it's always required or not, but it solved my issue.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 31, 2018, 10:02am UTC](https://discuss.elastic.co/t/kubernetes-autodiscover-not-shipping-logs-to-logstash/142861/5 "2018-08-31T10:02:20Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.