Docker.network_summary does not take hostfs into account

Elastic Stack Beats
, ,
1

When using docker.network_summary, I have the following error:
2021-12-01T13:56:00.159Z INFO module/wrapper.go:266 Error fetching data for metricset docker.network_summary: error fetching namespace for PID 4359: error reading network namespace link: readlink /proc/4359/ns/net: no such file or directory

PID 4359 comes from the host and is available in /hostfs mount:

sh-4.2# ll /hostfs/proc/4359/ns/net
lrwxrwxrwx. 1 root root 0 Dec  1 13:55 /hostfs/proc/4359/ns/net -> net:[4026531956]

I am not expert in Go but it seems like the hostfs is not taken into account into metricbeat/module/docker/network_summary/helper.go at line 81
My guess is that something like nsLink, err := os.Readlink(filepath.Join(paths.Hostfs, "/proc/", fmt.Sprintf("%d", pid), "/ns/net")) would fix the issue with the addition of "github.com/elastic/beats/v7/libbeat/paths" import

Should I create the issue on github ?

2

Hi @Julero!

I guess you are running Metricbeat inside a Docker container?

@Alex_Kristiansen could you verify if this is sth that we miss here?

3

So, unfortunately, some metricsets don't support reading from hostfs, and network_summary is one of them. We're working on consistently supporting an alternate hostfs across all of metricbeat.

4

Yes, Metricbeat is running inside a container to monitor a GCP vm and is reporting to an Elasticsearch on a GKE cluster

I am aware that docker.network_summary is beta as stated in the doc.

Do you think it would be fixed in the near future ?
Should I create the issue on github or is it already included in some hostfs related feature or bug ?