We got filebeat monitoring setup for the VM hosted apps and now trying to monitor logs of containers of docker swarm setup which uses json-file as a logging driver.
I have a filebeat (docker worker node) --> logstash --> elasticsearch configured,
Got the raw event passed to elasticsearch but it has only the container id of the docker as metadata, I am looking for more attributes like image, service and labels to be sent along with the event to make the dashboard more meaningful/useful.
My file beat config looks like,
- type: log paths: - '/mnt/docker/logs/containers/*/*.log' json.message_key: log json.keys_under_root: true processors: - add_docker_metadata: ~ fields: app_id: docker env: dev fields_under_root: true
Any pointer or help is appreciated.
Note: Elastic version : 6.3.2