So i got a home cluster running on Docker which is working fine and i can push data to it from filebeat and metricbeat, but im having issues understanding why my docker logs are not being sent to the cluster.
i have the path setup in my filebeat.yml and i can see in the log that it does pick up that path.
config
filebeat.inputs:
- type: log
enabled: true
paths:
- /var/log/*.log
- /var/lib/docker/containers/*/*.log
fields:
source_system: system
fields_under_root: true
logs:
2020-01-22T14:43:51.624-0600 INFO log/input.go:152 Configured paths: [/var/log/*.log /var/lib/docker/containers/*/*.log]
But for some reason the logs are not read, not even added to the registry.
2020-01-22T14:44:01.625-0600 DEBUG [input] input/input.go:152 Run input
2020-01-22T14:44:01.625-0600 DEBUG [input] log/input.go:191 Start next scan
2020-01-22T14:44:01.625-0600 DEBUG [input] log/input.go:421 Check file for harvesting: /var/log/Xorg.0.log
2020-01-22T14:44:01.625-0600 DEBUG [input] log/input.go:511 Update existing file for harvesting: /var/log/Xorg.0.log, offset: 39306
2020-01-22T14:44:01.625-0600 DEBUG [input] log/input.go:565 File didn't change: /var/log/Xorg.0.log
2020-01-22T14:44:01.625-0600 DEBUG [input] log/input.go:421 Check file for harvesting: /var/log/Xorg.1.log
2020-01-22T14:44:01.625-0600 DEBUG [input] log/input.go:511 Update existing file for harvesting: /var/log/Xorg.1.log, offset: 40622
2020-01-22T14:44:01.625-0600 DEBUG [input] log/input.go:565 File didn't change: /var/log/Xorg.1.log
2020-01-22T14:44:01.625-0600 DEBUG [input] log/input.go:421 Check file for harvesting: /var/log/pacman.log
2020-01-22T14:44:01.625-0600 DEBUG [input] log/input.go:511 Update existing file for harvesting: /var/log/pacman.log, offset: 640504
2020-01-22T14:44:01.625-0600 DEBUG [input] log/input.go:565 File didn't change: /var/log/pacman.log
2020-01-22T14:44:01.625-0600 DEBUG [input] log/input.go:212 input states cleaned up. Before: 3, After: 3, Pending: 0
Got my beat running in debug mode hoping i would see an error related to permissions or similar but no luck so far.
anything i could be missing?