# Using Filebeat on K8s - Trying to obtain App logs inside Pods

**URL:** <https://discuss.elastic.co/t/using-filebeat-on-k8s-trying-to-obtain-app-logs-inside-pods/224116>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [March 18, 2020, 1:23pm UTC](https://discuss.elastic.co/t/using-filebeat-on-k8s-trying-to-obtain-app-logs-inside-pods/224116 "2020-03-18T13:23:19Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![solijam](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/solijam/32/47985_2.png) [@solijam](https://discuss.elastic.co/u/solijam)\
**Post date:** [March 18, 2020, 1:23pm UTC](https://discuss.elastic.co/t/using-filebeat-on-k8s-trying-to-obtain-app-logs-inside-pods/224116/1 "2020-03-18T13:23:19Z")

</div>

Hello Team!

We are using Filbeat on Kubernetes - OCP configuration. Currently we have success on obtaining logs through Filebeat, but these only show what you would find by navigating on OCP 4.X Web console...  
Pods \> "specific pod" \> Logs

However, the Application team have set an Application log to temp path inside pod ( /web/server\_root\_www/tmp/.../ERR.log ).  
What would be the best approach for Filebeat to also collect that log ?

Any help or information is appreciated, thank you!

Below is our current configuration that picks up the container logs. Followed guide from this link:  
[https://www.elastic.co/guide/en/beats/filebeat/master/running-on-kubernetes.html](https://www.elastic.co/guide/en/beats/filebeat/master/running-on-kubernetes.html)

```auto
apiVersion: v1
kind: ConfigMap
metadata:
  name: filebeat-config
  namespace: kube-system
  labels:
    k8s-app: filebeat
data:
  filebeat.yml: |-
    filebeat.autodiscover:
      providers:
        - type: kubernetes
          node: ${NODE_NAME}
          hints.enabled: true
          hints.default_config:
            type: container
            paths:
              - /var/log/containers/*${data.kubernetes.container.id}.log
            logging.level: info

```

---

<div class="post-metadata">

**Author:** ![ConorTier](https://avatars.discourse-cdn.com/v4/letter/c/6de8d8/32.png) [@ConorTier](https://discuss.elastic.co/u/ConorTier)\
**Post date:** [March 24, 2020, 2:27pm UTC](https://discuss.elastic.co/t/using-filebeat-on-k8s-trying-to-obtain-app-logs-inside-pods/224116/2 "2020-03-24T14:27:54Z")

</div>

@solijam Please see below:

Basically dont use a demon set as as you wont access individual pods logs, use a persistent volume to store all logs then mount that within each pod.

Then 1 instance of filebeats to read the persistent volumn files.

Above should work - but im getting an error with file timeout not reading new inputs - hopefully somebody will point us to right direction

> [@Filebeats Kubernetes File close due to inactive of 5min](https://discuss.elastic.co/t/filebeats-kubernetes-file-close-due-to-inactive-of-5min/224855):
>
> Hey, Here is the setup currently have half working - Kubernetes - Amazon K8 - with a instance of logstash and file beats running on two pods - no demon sets for filebeats as want to read files from a specific directory on each of the pods (logs are stored in a volume mounted persistent volume- specifically azure file storage) - not interested in the pods docker stout. Also persistent volume to hold data from log files delta ids for redeployments as not to loose filebeats data deltas for files. …

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 21, 2020, 2:27pm UTC](https://discuss.elastic.co/t/using-filebeat-on-k8s-trying-to-obtain-app-logs-inside-pods/224116/3 "2020-04-21T14:27:55Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.