Docker + Persistent Registry = autodiscover failing

Elastic Stack Beats
1

Hi all,

I would like to run filebeat as a docker container. The idea would be to volume mount the data folder so the registry can persistent between container (or even host) crashes/restarts.

If I do so however, I get the following error when launching the filebeat container:

filebeat_1_f7b534c88448 | 2018-11-21T10:44:56.511Z ERROR [autodiscover] cfgfile/list.go:96 Error creating runner from config: No paths were defined for input accessing config

This does not seem to always happen but especially if filebeat has been up for some time?

2

Hi @lifeofguenter,

Could you please paste the settings you are using?

3

filebeat.yml:

filebeat.autodiscover:
  providers:
    - type: docker
      templates:
        - condition:
            has_fields:
              - docker.container.labels.com.foobar.logs.type
          config:
            - type: docker
              containers.ids:
                - "${data.docker.container.id}"
              paths:
                - /var/lib/docker/containers/${data.docker.container.id}/*.log
              fields:
                log_type: "${docker.container.labels.com.foobar.logs.type}"

filebeat.inputs:
  - type: log
    paths:
      - /var/hostlog/syslog
    fields:
      log_type: syslog

  - type: log
    paths:
      - /var/hostlog/auth.log
    fields:
      log_type: sysauth

processors:
  - add_cloud_metadata: ~
  - add_docker_metadata: ~

output.redis:
  hosts: ["${REDIS_HOST}"]
  key: "filebeat"
  db: 0
  timeout: 10

Works with empty data folder and also mostly after restarting the container. Just after some time it will fail.

4

seems to be independent of having a persistent registry. but for some reason using this docker-compose.yml will sometimes fail with the above error:

version: '3.7'

services:
  redis:
    image: redis:3.2-alpine
    container_name: logs-logstash_redis

  logstash:
    image: docker.elastic.co/logstash/logstash:6.5.1
    depends_on:
      - redis
    environment:
      REDIS_HOST: redis
    entrypoint: /usr/local/bin/custom-entrypoint.sh

  filebeat:
    image: docker.elastic.co/beats/filebeat:6.5.1
    command:
      - -e
      - -strict.perms=false
    depends_on:
      - logstash
    environment:
      REDIS_HOST: redis
    volumes:
      - /var/log:/var/hostlog:ro
      - /var/lib/docker/containers:/var/lib/docker/containers:ro
      - /var/run/docker.sock:/var/run/docker.sock

  # only needed to generate logs
  nginx:
    image: nginx:1.14-alpine
    container_name: logs-logstash_nginx
    depends_on:
      - filebeat
    ports:
      - '127.0.0.1:8181:80'
    volumes:
      - ${PWD}/nginx.conf:/etc/nginx/nginx.conf:ro
    labels:
      com.foobar.logs.type: nginx
5

Actually this is also happening when running filebeat directly on the host (installed via official apt repo).

running systemctl restart filebeat multiple times will sometimes cause this unrecoverable issue:

2018-11-22T15:12:31.100+0200 ERROR [autodiscover] cfgfile/list.go:96 Error creating runner from config: No paths were defined for input accessing config

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.