# Which configuration to use for Filbeat and Kubernetes container or pods?
**URL:** https://discuss.elastic.co/t/which-configuration-to-use-for-filbeat-and-kubernetes-container-or-pods/365283
**Category:** Beats
**Tags:** filebeat
**Created:** [August 21, 2024, 12:56pm UTC](https://discuss.elastic.co/t/which-configuration-to-use-for-filbeat-and-kubernetes-container-or-pods/365283 "2024-08-21T12:56:05Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@javadevmtl](https://discuss.elastic.co/u/javadevmtl)
#### Post date: [August 21, 2024, 12:56pm UTC](https://discuss.elastic.co/t/which-configuration-to-use-for-filbeat-and-kubernetes-container-or-pods/365283/1 "2024-08-21T12:56:05Z")
Hi when configuring Filbeat, it seems the default prefered method in the docs is to use /var/log/containers
But if I understand correctly, it's better to setup the /var/log/pods folder. Since Kubernetes rotates it's logs since 1.21.x and also /var/logs/containers has symlink to the files, which is also not great?
---
### Author:  [@Trevor\_Blackford](https://discuss.elastic.co/u/Trevor_Blackford)
#### Post date: [August 21, 2024, 1:18pm UTC](https://discuss.elastic.co/t/which-configuration-to-use-for-filbeat-and-kubernetes-container-or-pods/365283/2 "2024-08-21T13:18:15Z")
I think you are correct and we should update documentation. We do provide this note - `/var/log/containers/\*.log` is normally a symlink to `/var/log/pods/*/*.log` , so above paths can be edited accordingly
> **[Log input | Filebeat Reference \[8.15\] | Elastic](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-log.html)**
More detail on symlinks and rotating logs here: [Log input | Filebeat Reference [8.15] | Elastic](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-log.html#rotating-logs)
---
### Author:  [@javadevmtl](https://discuss.elastic.co/u/javadevmtl)
#### Post date: [August 21, 2024, 8:03pm UTC](https://discuss.elastic.co/t/which-configuration-to-use-for-filbeat-and-kubernetes-container-or-pods/365283/3 "2024-08-21T20:03:06Z")
So what's the correction, what should I configure for the input?
Also the helm chart defaults to /var/logs/container...
---
### Author:  [@javadevmtl](https://discuss.elastic.co/u/javadevmtl)
#### Post date: [August 24, 2024, 8:01pm UTC](https://discuss.elastic.co/t/which-configuration-to-use-for-filbeat-and-kubernetes-container-or-pods/365283/4 "2024-08-24T20:01:03Z")
Is it just switching the path to the `/var/log/pods/*/*.log` or what ever the case? I tried and it didn't work. Or we have to switch the type from container to something else as well?
---
### Author:  [@javadevmtl](https://discuss.elastic.co/u/javadevmtl)
#### Post date: [September 26, 2024, 3:53pm UTC](https://discuss.elastic.co/t/which-configuration-to-use-for-filbeat-and-kubernetes-container-or-pods/365283/5 "2024-09-26T15:53:53Z")
Drive by comment? hehe
See my questions above. Do we want to open an issue to improve the docs? Anything else?