I am evaluating FileBeat 6.0.0-rc1.
It seems as if this configuration:
processors: - add_docker_metadata: host: "unix:///var/run/docker.sock"
works fine and docker fields gets added, but filebeat ignores docker files that are not generated by the docker engine.
Like with this configuration:
paths: - /var/lib/docker/containers/*/*.log # these are harvested fine and docker data is added and sent to output - /var/log/*.log # no data goes to output - /var/log/messages # # no data goes to output
Shouldn't it be possible for filebeat to add docker meta data for the docker log files and harvest the other log files without adding the docker meta data, since there is none? I expected that both should be send to output, and only the docker log files should have the docker meta data.
I have tested this both with the config above and by using the system module, with its default config.
System module and the harvester by path /var/lib/docker/containers//.log, both works fine until I config the add_docker_metadata processor, which makes system module stop producing any data to output.