Autodiscover - docker - catch all others

Elastic Stack Beats
1

Hello,

I want to setup autodiscover of type docker, do some special configs for some images and at the end I want to catch all other containers to log as is.
But i haven't found how to configure the 'catch all others'.
Can someone give me some hints?

i just found the condition - not - contains / equals - docker.container.image
is this the only way?

when i do a condition - regex - '.*' at the end, i get double configured prospectors & logs
maybe it would be nice to only configure one prospector on autodisover and don't go to other condition if a match is found?

thank you for help.

2

Please share the autodiscover config that you are using. It sounds like you are doing it correctly by implementing your "catch all" as the negation of your other condition.

3

Yes for now it works, cause i only have one special configuration.

filebeat.autodiscover:
  providers:
    - type: docker
      templates:
        - condition:
            contains:
              docker.container.image: tomcat
          config:
            - type: docker
              containers.ids:
                - "${data.docker.container.id}"
              multiline.pattern: '^([0-9]{4}-[0-9]{2}-[0-9]{2}|(Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec) \d\d)'
              multiline.negate: true
              multiline.match: after
              fields:
                autodiscover: 'image-tomcat'
              pipeline: tomcat_level
        - condition:
            not:
              contains:
                docker.container.image: tomcat
          config:
            - type: docker
              containers.ids:
                - "${data.docker.container.id}"
              fields:
                autodiscover: 'default'

but if i add some more container / image specific config it can get confusing fast. or am i wrong?
so i thought it would be nicier if it stops on first condition match, cause you never want to mach more than one.
or are there cases where more than one match is needed in the autodiscover pipe?

4

The person who has probably spent the most time thinking about auto-discover config is @exekias.

@exekias, is there a better way to handle this "catch all" case?

5

Hi,

I'm afraid we don't have one yet, this is the open issue to implement this: https://github.com/elastic/beats/issues/6084

Best regards

6

Thank you for the information.
Nice to hear this is already addressed.

7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.