I'm currently using filebeat 8.3.0 and we're copying a few container LABELS to fields via something like this:
- copy_fields: fields: - from: container.labels.custom_label to: custom_label
We have a few containers that populate environment variables with something like this:
"Env": [ "CONTAINER_RELEASE=100133", "LOGSTASH_FIELDS=env=dev,role=custom-role,service=myservice,build=123456,test_session_id=987654" ]
I can't seem to find a way in filebeat to ingest environment variables from the docker containers TO a custom field like we're doing with the labels. Is this possible, and if so how? Documentation doesn't seem to indicate it is so I'm leaning towards thinking we're going to need to modify our container config to send the Environment variable data to a label instead.
Would appreciate some guidance here.