Can filebeats to read lxc container logs?

[yuecong (Cong Yue)]

from the host, I can read the lxc contianers logs using root like
/var/lib/lxc//test//logs/*.log
but when I put the above path into filebeats as one path for log type of inputs , it can not find it.( A harvester on the above path is not created). I also tried to use the container input type, also it does not work.

How can I debug why filebeats can not read it even the folder is readable from the host using root?

[faec (Fae Charlton)]

Hi! Are the double-slashes in your path intentional? It looks like you want /var/lib/lxc/test/logs/*.log but instead have /var/lib/lxc//test//logs/*.log. Perhaps that's just a typo, though -- if that doesn't fix it, could you share your filebeat.yml? What you want should be possible but more information will help troubleshoot where it's going wrong.

[yuecong (Cong Yue)]

ah. it is a typo. and here is the whole filebeat.yml with redacting some credentials

filebeat.inputs:

• type: log
  paths:
  • /var/log/*.log
  • /var/lib/lxc//test//logs/*.log

processors:

• add_cloud_metadata: ~

output.elasticsearch:
hosts: ["http://xxxx:9200"]
username: beats_system
password: xxx
monitoring.enabled: true
monitoring.elasticsearch:
username: beats_system
password: xxxxx

---

are the logs below /var/log/.log can be shipped vi filebeats and I can see one harvester created for each log, bit for /var/lib/lxc//test//logs/.log, I can not see any harvester created for the files here.
Also I can not see any errors on this.
As I mentioned above, I can access those files using root, and also filebeat are launched using root.

Let me know what info I could provide for your further insights on this.

Thanks

[yuecong (Cong Yue)]

@faec any insights on this? Thanks