Convert/Ingest Docker container Environment Variables into Filebeat/Logstash fields

Elastic Stack Beats
,
1

I'm currently using filebeat 8.3.0 and we're copying a few container LABELS to fields via something like this:

- copy_fields:
      fields:
        - from: container.labels.custom_label
          to: custom_label

We have a few containers that populate environment variables with something like this:

 "Env": [
                "CONTAINER_RELEASE=100133",
                "LOGSTASH_FIELDS=env=dev,role=custom-role,service=myservice,build=123456,test_session_id=987654"
]

I can't seem to find a way in filebeat to ingest environment variables from the docker containers TO a custom field like we're doing with the labels. Is this possible, and if so how? Documentation doesn't seem to indicate it is so I'm leaning towards thinking we're going to need to modify our container config to send the Environment variable data to a label instead.

Would appreciate some guidance here.

Thanks,
Julian

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.