Filebeat 7.0.0 on docker with Autodiscover and deploy mode: global

Elastic Stack Beats
,
1

Hi guys,
I'm trying to deploy a stack to a swarm using autodiscover configuration for Filebeat service 7.0.0 (https://www.elastic.co/guide/en/beats/filebeat/current/configuration-autodiscover.html) , this is my filebeat.yml:

filebeat.autodiscover:
  providers:
    - type: docker
      labels.dedot: true
      templates:
        - condition:
            contains:
              docker.container.name: mystackname_
          config:
            - type: docker
              containers.ids:
                - "${data.docker.container.id}"
              exclude_lines: ["^\\s+[\\-`('.|_]"]  # drop asciiart lines
setup.kibana:
host: "kibana-mon:5601"
output.logstash:
  hosts: ["logstash:5044"]
processors:
  - add_host_metadata: ~

My swarm consists of three nodes, 1 manager and 2 worker. When I deploy my docker-compose.yml

filebeat:
    image: DOCKER_REGISTRY:5000/filebeat-myimage:latest
    volumes:
        - /var/lib/docker/containers:/var/lib/docker/containers:ro
        - /var/run/docker.sock:/var/run/docker.sock:ro
    user: root
    deploy:
        mode: global
        restart_policy:
            condition: on-failure
            delay: 10s
            max_attempts: 5
    networks:
        - mynet

I'm observing that the Filebeat service starts only in the manager node and not in the worker nodes. How can deploy Filebeat (with autodiscover) in all node of my swarm ?

Note that I haven't any problem with Input type Log instead of Docker (https://www.elastic.co/guide/en/beats/filebeat/current/configuration-filebeat-options.html)

thanks for your help
Diego

1 Like
2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.