Though I could successfully use add_docker_metadata with "~" as well as if I set match_source: true
But i am unable to get it to work if i set match_source: false. Please see my config below.
Not sure if it's because of the "fields" in match_fields/match_pids, though i've tried with some other fields as well..it more looks like at runtime the value of the fields is not found. Although I see no clue in logs (even debug level)
filebeat.prospectors: - type: docker enabled: true containers: path: /var/lib/docker/containers ids: "*" processors: - add_docker_metadata: host: "unix:///var/run/docker.sock" match_fields: ["system.process.cgroup.id"] match_pids: ["process.pid", "process.ppid"] match_source: false match_source_index: 4 match_short_id: true
I've tried this with filebeat 6.2.4 as well as 6.3
Tried both with
- type: log and
- type: docker
Any help/pointer is appreciated.