Filebeat does not update the value of the container image tag when it sends logs to Elasticsearch

[gun082544]

Hey everyone,

I've encountered an issue where, after changing the container service image tag from dev.com:v1.0.0 to dev.com:v2.0.0, the logs are still being sent to Elasticsearch with the image tag showing as dev.com:v1.0.0.

I attempted to resolve this by restarting Filebeat, which successfully sent the logs with the updated image tag dev.com:v2.0.0.

I'm using Filebeat v7.9.2 in the RKE cluster.

How can I handle this issue?

Thank you.

[botelastic[bot]]

This issue doesn't have a Team:<team> label.

[botelastic[bot]]

Hi! We just realized that we haven't looked into this issue in a while. We're sorry!

We're labeling this issue as Stale to make it hit our filters and make sure we get back to it as soon as possible. In the meantime, it'd be extremely helpful if you could take a look at it as well and confirm its relevance. A simple comment with a nice emoji will be enough :+1. Thank you for your contribution!