# Logging only kubelet logs

**URL:** <https://discuss.elastic.co/t/logging-only-kubelet-logs/226694>\
**Category:** Beats\
**Tags:** docker, filebeat\
**Created:** [April 6, 2020, 11:35am UTC](https://discuss.elastic.co/t/logging-only-kubelet-logs/226694 "2020-04-06T11:35:41Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Mario\_Albo\_Soria](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mario_albo_soria/32/46467_2.png) [@Mario\_Albo\_Soria](https://discuss.elastic.co/u/Mario_Albo_Soria)\
**Post date:** [April 6, 2020, 11:35am UTC](https://discuss.elastic.co/t/logging-only-kubelet-logs/226694/1 "2020-04-06T11:35:41Z")

</div>

Hi everybody!  
I have a Kubernets cluster deployed with RKE. When you deploy using RKE, the kubelet is not deployed as a pod, but it is deployed as a Docker container.  
I want to collect logs from **kubelet** container and ignore the rest of containers logs.  
I'm using the following configuratión on my filebeat.yaml but seems to ignore it and getting all containers logs.  
Can someone tell me if there is something missing or perhaps I'm not configuring correctly.  
Currente FIlebeat version: 7.6.2

```auto
filebeat.yml: |-
    filebeat.config: 
      spool_size: 512
    filebeat.inputs: 
      - type: docker 
        containers.ids: 
          - "*"
        fields_under_root: true
        tail_files: true
        processors:
          - add_docker_metadata: ~
          - add_kubernetes_metadata:
              kube_config: ~/.kube/config
          - drop_event:
              when:
                regexp:
                  docker.container.name: "^k8s.*"                 
    filebeat.autodiscover:
      providers:
        - type: docker
          templates:
            - condition:
                contains:
                  docker.container.name: kubelet
              config:
                - type: container
                  paths:
                    - /var/lib/docker/containers/${data.docker.container.id}/*.log
                  exclude_lines: ["^\\s+[\\-`('.|_]"] # drop asciiart lines
    output.file:
      path: "/tmp/filebeat"
      filename: filebeat

```

Thanks for helping!

---

<div class="post-metadata">

**Author:** ![jsoriano](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jsoriano/32/27920_2.png) [@jsoriano](https://discuss.elastic.co/u/jsoriano)\
**Post date:** [April 6, 2020, 7:00pm UTC](https://discuss.elastic.co/t/logging-only-kubelet-logs/226694/2 "2020-04-06T19:00:45Z")

</div>

Hey @Mario_Albo_Soria, welcome to discuss 🙂

It seems that you are configuring both, a static input configuration with `filebeat.inputs`, and a dynamic one with `autodiscover`. If your kubelet is being executed as a docker container, and it contains kubelet on its name, the autodiscover configuration should be enough.

The `filebeat.inputs` configuration you have there is configured for all containers, could you try to remove it, and use only the configuration in autodiscover?

---

<div class="post-metadata">

**Author:** ![Mario\_Albo\_Soria](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mario_albo_soria/32/46467_2.png) [@Mario\_Albo\_Soria](https://discuss.elastic.co/u/Mario_Albo_Soria)\
**Post date:** [April 7, 2020, 6:42am UTC](https://discuss.elastic.co/t/logging-only-kubelet-logs/226694/3 "2020-04-07T06:42:19Z")

</div>

It works!!  
I was misunderstanding how the `filebeat.inputs` works, I thought I needed to add metadata to logs before filtering with the `filebeat.autodiscover` (I read something similar there [[Problem getting autodiscover docker to work with filebeat](https://discuss.elastic.co/t/problem-getting-autodiscover-docker-to-work-with-filebeat/144349/10)])

Thank you so much!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 5, 2020, 6:42am UTC](https://discuss.elastic.co/t/logging-only-kubelet-logs/226694/4 "2020-05-05T06:42:35Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.