Add Docker metadata to logs shipped with filebeat?

Elastic Stack Beats
1

Is there any way to attach Docker information from hosts like container images, ids, etc. with filebeat? If not, is there any other way to get this metadata from hosts into Logstash?

It looks like the Fluentd client does something like this but I haven't been able to get fluent talking to Logstash reliably.

2

If you are reading JSON logs from /var/lib/docker/containers/ you could parse the container ID from the source field using Ingest Node or Logstash.

If you happen to also be running Metricbeat with the Docker module enabled you could correlate the ID from the logs with other info about the container like name, image, and runtime metrics.

We are going to be working on improving the whole container experience for 6.0. And adding metadata to the logs is one of things that should get easier.

3

Thanks for the quick response and the information. Any ballpark idea of how far out the 6.0 release is?

4

This topic was automatically closed after 21 days. New replies are no longer allowed.