# Filebeat kubernetes

**URL:** <https://discuss.kubernetes.io/t/filebeat-kubernetes/2961>\
**Category:** General Discussions\
**Created:** [October 1, 2018, 11:28am UTC](https://discuss.kubernetes.io/t/filebeat-kubernetes/2961 "2018-10-01T11:28:22Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![garcia](https://avatars.discourse-cdn.com/v4/letter/g/ecc23a/32.png) [@garcia](https://discuss.kubernetes.io/u/garcia)\
**Post date:** [October 1, 2018, 11:28am UTC](https://discuss.kubernetes.io/t/filebeat-kubernetes/2961/1 "2018-10-01T11:28:22Z")

</div>

hello, I have installed this documentation  
[https://www.elastic.co/guide/en/beats/filebeat/master/running-on-kubernetes.html#running-on-kubernetes](https://www.elastic.co/guide/en/beats/filebeat/master/running-on-kubernetes.html#running-on-kubernetes)  
but I have a problem, logs elasticsearch

```
[filebeat-6.4.1-2018.09.28] [0] failed to execute bulk item (index) BulkShard
Request [[filebeat-6.4.1-2018.09.28] [0]] containing [10] requests
org.elasticsearch.index.mapper.MapperParsingException: failed to parse [kubernetes.labels.app]

```

my indexes are in elasticsearch

```
curl localhost:9200/_cat/indices
yellow open filebeat-6.4.1-2018.09.28 V8uZgvoBQ7KmKEBA9VXE-Q 5 1 29833362 0 41gb 41gb
yellow open filebeat-6.4.1-2018.09.27 TxyduJ9FRxu4CQduQKqxFQ 5 1 4251 0 1.2mb 1.2mb
green open .kibana DgMyQx7QSK659uBo1CccJQ 1 0 3 0 34.3kb 34.3kb

```

how do i fix this error? I understand it is necessary to remove the filebeat version, but maybe I’m wrong, tell me the solution

---

<div class="post-metadata">

**Author:** ![jeefy](https://sea2.discourse-cdn.com/flex016/user_avatar/discuss.kubernetes.io/jeefy/32/35_2.png) [@jeefy](https://discuss.kubernetes.io/u/jeefy)\
**Post date:** [October 1, 2018, 4:27pm UTC](https://discuss.kubernetes.io/t/filebeat-kubernetes/2961/2 "2018-10-01T16:27:10Z")

</div>

At a glance it looks like the (elasticsearch) template that index uses can’t parse out labels.

---

<div class="post-metadata">

**Author:** ![garcia](https://avatars.discourse-cdn.com/v4/letter/g/ecc23a/32.png) [@garcia](https://discuss.kubernetes.io/u/garcia)\
**Post date:** [October 1, 2018, 4:58pm UTC](https://discuss.kubernetes.io/t/filebeat-kubernetes/2961/3 "2018-10-01T16:58:49Z")

</div>

you can tell me what the problem is?  
and I have logs of /var/lib/docker/containers weighing 25 G, and the elasticsearch is written already more than 40 G and is written more…  
and I do not understand at all whether this [documentation](https://www.elastic.co/guide/en/beats/filebeat/master/running-on-kubernetes.html#running-on-kubernetes) works or I do something wrong