Adding metadata with autodiscover is not working

Elastic Stack Beats
1

Hi everybody,
I'm trying to add docker and host metadata with autodiscover because I need docker.container.name and host.ip fields to correctly index my logs.
I'm using autodiscover option because I only need to harvest kubelet logs.

Component versions:
Filebeat 7.6.2
Logstash 7.1

I have tried this two configurations but it don't seems to append any new field:
First config:

apiVersion: v1
kind: ConfigMap
metadata:
  name: filebeat-config
  labels:
    k8s-app: filebeat
data:
  filebeat.yml: |-
    filebeat.config: 
      spool_size: 512                 
    filebeat.autodiscover:
      providers:
        - type: docker
          processors:
            - add_docker_metadata: ~
            - add_host_metadata:
                netinfo.enabled: true
                cache.ttl: 5m
          templates:
            - condition:
                contains:
                  docker.container.name: kubelet
              config:
                - type: container
                  paths:
                    - /var/lib/docker/containers/${data.docker.container.id}/*.log
                  exclude_lines: ["^\\s+[\\-`('.|_]"]
    output.file:
      path: "/tmp/filebeat"
      filename: filebeat

Second config, very similar to the first one:

apiVersion: v1
kind: ConfigMap
metadata:
  name: filebeat-config
  labels:
    k8s-app: filebeat
data:
  filebeat.yml: |-
    filebeat.config: 
      spool_size: 512                 
    filebeat.autodiscover:
      providers:
        - type: docker
          templates:
            - condition:
                contains:
                  docker.container.name: kubelet
              config:
                - type: container
                  paths:
                    - /var/lib/docker/containers/${data.docker.container.id}/*.log
                  exclude_lines: ["^\\s+[\\-`('.|_]"]
                  processors:
                    - add_docker_metadata: ~
                    - add_host_metadata: ~
    output.file:
      path: "/tmp/filebeat"
      filename: filebeat

There is something that I'm missing or missunderstanding?

Thanks for your help!

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.