Add docker metadata not working even after trying all possible combinations

Elastic Stack Beats
1

Am able to visualise the docker logs on kibana but with container id. I want to add container name to my logs for easy filtering.I have tried add_docker_metadata: ~ but in vain.I have tried differnt possible combinations but container names are not getting displayed in kibana.Is there any other way out?Please help me ASAP as am stuck in this for a long time and in a urgent need to complete the task soon.Thanks in advance.

2
  1. Are you running the beat on the host or also in a container (as a sidecar)?
  2. Please show your configuration and the logs. There is no way for us to guess what is going on.
4

34%20PM
Screen Shot 2018-11-26 at 12.07.34 PM.png1440×709 134 KB

Thank yu for the reply ! Please help me in resolving this issue..i want to add container name to my log files for displaying in kibana

5

My filebeat service is working fine now after i made some indentation changes to filebeat.yml.The only prb that persists is related to fetching container names now..please help !

6

Then please provide your current config and log output as text (formatted as a code block).

There should be a log line about the processors you are loading. And it looks like you are not running on a cloud, so remove the add_cloud_metadata first.

7

I have removed it and my docker metadata is working fine..am able to fetch container names after setting the prospectors to true ..but now my filebeat is not fetching logs from all files..its fetching only from 2 containers ..though my path for logs is /var/log/docker/containers//.log .Previously it was working fine..can yu suggest on this?

8

again, we need the logs. there you will have an entry for every file that is being collected.

taking a wild guess: only those 2 contsiners have more recent log entries. remove filebeat‘s registry file and restart it to collect everything again.

10

i removed registry and restarted ..still the same issue

11
  1. Please stop the screenshots and paste your outputs. It's a pain to read and nobody running into the same issue will be able to find it since it's not searchable text.
  2. Do you happen to have tried this with an older Filebeat version and are using the index template of that? A GET _template in Console should show you more.
  3. "when i run the filebeat in debug mode am visualising all the logs but they are not showing up in kibana" — not sure how to read this. Is it being shown correctly in Kibana or not?
16

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.