# Moving from filebeats 6.8 to 7.10
**URL:** https://discuss.elastic.co/t/moving-from-filebeats-6-8-to-7-10/310851
**Category:** Beats
**Tags:** docker, filebeat
**Created:** [July 28, 2022, 10:37am UTC](https://discuss.elastic.co/t/moving-from-filebeats-6-8-to-7-10/310851 "2022-07-28T10:37:34Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@Ryan5](https://discuss.elastic.co/u/Ryan5)
#### Post date: [July 28, 2022, 10:37am UTC](https://discuss.elastic.co/t/moving-from-filebeats-6-8-to-7-10/310851/1 "2022-07-28T10:37:34Z")
Hi,
We are trying to move from filebeats version 6.8 to 7.10 however, the way to collect docker logs seems to have changed and following the [new autodiscover method](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-autodiscover.html) docker logs are not appearing in elasticsearch but normal non docker logs are. Our logstash version 7.16 processor adds a few things then passes to ES.
Is there an issue with our filebeat.yml file? Not sure on the best way to debug this is as im not seeing much in any log files on the boxes. `filebeat test config` returns Config OK
OLD CONFIG
```auto
filebeat.inputs:
- type: docker
containers.ids : '*'
containers.stream: all
fields:
pipeline_marker: "application"
service: "Monitoring"
server_name: "AWSServerName"
processors:
- add_docker_metadata: ~
json.keys_under_root: true
json.add_error_key: true
json.message_key: message
```
NEW CONFIG
```auto
filebeat.autodiscover:
providers:
- type: docker
templates:
config:
- type: container
paths:
- /var/lib/docker/containers/${data.docker.container.id}/*.log
fields:
pipeline_marker: "application"
service: "Monitoring"
server_name: "AWSServerName"
processors:
- add_docker_metadata: ~
json.keys_under_root: true
json.add_error_key: true
json.message_key: message
```
PROCESSOR
```auto
input {
pipeline {
address => "processor-simple"
}
}
filter {
mutate {
add_field => { "[innerindex]" => "service-%{[fields][service]}-%{+YYYY.MM.dd}" }
add_field => { "[logstashProcessor]" => "processor-simple" }
# Teams message
add_field => {"[@metadata][teams_webhook_url]" => ""}
add_field => {"[@metadata][teams_message]" => '{}'
}
}
output {
if [notifications][raiseNotification] {
pipeline { send_to => "dispatcher-teams" }
}
pipeline { send_to => "dispatcher-elasticsearch" }
}
```
---
### Author:  [@TiagoQueiroz](https://discuss.elastic.co/u/TiagoQueiroz)
#### Post date: [August 1, 2022, 10:59am UTC](https://discuss.elastic.co/t/moving-from-filebeats-6-8-to-7-10/310851/2 "2022-08-01T10:59:02Z")
Hi @Ryan5
There seems to be a small issue with your yaml, here is the fixed version:
```auto
filebeat.autodiscover:
providers:
- type: docker
templates:
- config:
- type: container
paths:
- '/var/lib/docker/containers/${data.docker.container.id}/*.log'
fields:
pipeline_marker: application
service: Monitoring
server_name: AWSServerName
processors:
- add_docker_metadata: null
json.keys_under_root: true
json.add_error_key: true
json.message_key: message
```
The `templates` key needs to be an array.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 29, 2022, 12:59pm UTC](https://discuss.elastic.co/t/moving-from-filebeats-6-8-to-7-10/310851/3 "2022-08-29T12:59:57Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.