# Logs parsing error post upgrading filebeat from 5.x to 7.x

**URL:** <https://discuss.elastic.co/t/logs-parsing-error-post-upgrading-filebeat-from-5-x-to-7-x/246808>\
**Category:** Beats\
**Tags:** docker, filebeat\
**Created:** [August 28, 2020, 6:02pm UTC](https://discuss.elastic.co/t/logs-parsing-error-post-upgrading-filebeat-from-5-x-to-7-x/246808 "2020-08-28T18:02:10Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![latif.siddiqui](https://avatars.discourse-cdn.com/v4/letter/l/d07c76/32.png) [@latif.siddiqui](https://discuss.elastic.co/u/latif.siddiqui)\
**Post date:** [August 28, 2020, 6:02pm UTC](https://discuss.elastic.co/t/logs-parsing-error-post-upgrading-filebeat-from-5-x-to-7-x/246808/1 "2020-08-28T18:02:10Z")

</div>

We recently updated the filebeat to 7.9.0 for ECS Clusters but after updating it stopped parsing the logs and sending file path in the log field.

sample log:

```auto
log": {
      "file": {
        "path": "/var/lib/docker/containers/<container_id>/<cluster_name>@<container_name>@<tag_name>@0@<service_name>@latest.nlog"
      },

```

Sample logs before updating the filebeat:

```auto
{
....
....
"log": "<actual_log>"
"source": "/var/lib/docker/containers/<container_id>/<cluster_name>@<container_name>@<tag_nmae>@0@<service_name>@latest.nlog"
....
....
}

```

Filebeat Config:

```auto
 filebeat.inputs:
- type: log
  enabled: true
  paths:
    - /var/lib/docker/containers/*/*.nlog
  json.keys_under_root: true
  json.message_key: log
  json.add_error_key: true
  json.overwrite_keys: true
  symlinks: true
  fields_under_root: true
  fields:
    level: debug
    type: docker_json
    category: <index_name>

```

logstash mapping:

before (with 5.x)

```auto
    match => {
        "source" => "%{GREEDYDATA}\/%{GREEDYDATA:ecs_cluster_name}@%{GREEDYDATA:ecs_container_name}@%{GREEDYDATA:ecs_task_definition_family}@%{GREEDYDATA:ecs_task_definition_version}@%{GREEDYDATA:ecs_image_basename}@%{GREEDYDATA:ecs_image_tag}.nlog"
      }
    }

```

With 7.9:

```auto
    match => {
        "[log][file][path]" => "%{GREEDYDATA}\/%{GREEDYDATA:ecs_cluster_name}@%{GREEDYDATA:ecs_container_name}@%{GREEDYDATA:ecs_task_definition_family}@%{GREEDYDATA:ecs_task_definition_version}@%{GREEDYDATA:ecs_image_basename}@%{GREEDYDATA:ecs_image_tag}.nlog"
      }
    }

```

So instead of file content, there is path field. So we suspect, its something to do with source and log.file.path.

any help would be appreciated.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 25, 2020, 8:02pm UTC](https://discuss.elastic.co/t/logs-parsing-error-post-upgrading-filebeat-from-5-x-to-7-x/246808/2 "2020-09-25T20:02:22Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.