Add_kubernetes_metadata logs_path does not use provided value from config

Elastic Stack Beats
1

I just deployed filebeat 7.8.0 in Kubernetes. I cannot get the add_kubernetes_metadata to work correctly using logs in /var/log/containers folder location. I need to use that location because I am filtering on container logs using exclude_files, which would be like ["/var/log/containers/elasticsearch-*","/var/log/containers/filebeat-*",.......]

filebeat has volumes mounted for both /var/log and /var/lib/docker/containers.

Relevant config:

    filebeat.inputs:
    - type: container
      exclude_files: ${FILEBEAT_EXCLUDE_FILES}
      paths:
      - /var/log/containers/*.log
      processors:
      - add_kubernetes_metadata:
          in_cluster: true
          default_matchers.enabled: false
          host: ${NODE_NAME}
          matchers:
          - logs_path:
              logs_path: "/var/log/containers/"
              resource_type: "container"

Errors in filebeat logs:
ERROR [kubernetes] add_kubernetes_metadata/matchers.go:91 Error extracting container id - source value does not contain matcher's logs_path '/var/lib/docker/containers/'.

Am I missing something?

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.