Docker logs being written to file

Elastic Stack Beats
1

I'm testing the auditbeat docker image using the kubernetes manifest linked from here:
https://www.elastic.co/guide/en/beats/auditbeat/7.2/running-on-kubernetes.html

It appears the auditbeat logs are being written to a file, /usr/share/auditbeat/logs/auditbeat

Filebeat/metricbeat docker images write to stdout, so are available using kubectl logs <image>

The manifest is missing an arguement, "-e", to send the logs to stdout.
ie

        args: [
          "-c", "/etc/auditbeat.yml", "-e"
        ]

Says to logs bugs here before creating an issue.
Thanks

2

Thanks for following the procedure and reporting the issue here first :smile:. Would you be able to open a PR to fix this file and then run make from the deploy/kubernetes dir to update the generated auditbeat-kubernetes.yaml? Otherwise please open a new issue on Github as this is definitely bug.

3

Thanks. Pull request done, I think

4

This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.