I have a kubernetes cluster. In this cluster, I have a lot of pods and some of them contains spring boot application. Everything works good butr I would like to use ElasticSearch to logs every pods and metrics.

Here is my stack : Spring-boot <- Filebeat -> Logastash -> ElasticSearch <- Kibana.

Every logs are visible in kibana except spring boot logs. When I look Filebeat logs I can find this error : File is inactive : var/lib/containers//.log

I don't understand why Filebeat can't read this logs.

Here is my configuration of springboot and filebeat :

Filebeat values

     image:
      repository: docker.elastic.co/beats/filebeat
      tag: 7.0.1
     pullPolicy: Always
     overrideConfig:
        filebeat.config:
          modules:
            path: ${path.config}/modules.d/*.yml
            reload.enabled: false
        filebeat.inputs:
          - enabled: true
            paths:
              - /var/log/*.log
              - /var/log/messages
              - /var/log/syslog
            type: log
          - containers.ids:
              - '*'
            type: docker
            enabled: true
        processors:
          - add_kubernetes_metadata:
              in_cluster: true
          - drop_event:
              when:
                equals:
                  kubernetes.container.name: filebeat
        http.enabled: true
        http.port: 5066
        output:
          file:
            enabled: false
          logstash:
            hosts:
              - "elastic-stack-logstash:5044"

Spirng Boot logback

<?xml version="1.0" encoding="UTF-8"?>
<configuration>

    <springProperty scope="context" name="application_name" source="spring.application.name"/>

    <appender name="jsonConsoleAppender" class="ch.qos.logback.core.ConsoleAppender">
        <encoder class="net.logstash.logback.encoder.LogstashEncoder"/>
    </appender>

    <root level="INFO">
        <appender-ref ref="jsonConsoleAppender"/>
    </root>

</configuration>

Is Someone faces this issue or have a solution ?

Thank you everyone