Filebeat add docker metada fail

Elastic Stack Beats
1

Hello everybody, I'm having this issue when try to get docker metada. This is myconfiguration:

filebeat.inputs:
- type: docker
  combine_partial: true
  containers:
    path: "/usr/share/dockerlogs/data"
    stream: "all"
    ids:
      - "*"
processors:
  # decode the log field (sub JSON document) if JSON encoded, then maps it's fields to elasticsearch fields
- decode_json_fields:
    fields: ["log", "message"]
    target: ""
    # overwrite existing target elasticsearch fields while decoding json fields    
    overwrite_keys: true
- add_docker_metadata:
    #host: "unix:///var/run/docker.sock"

output.console:
  pretty: true

and in container volume i do use /var/run/docker.sock:/var/run/docker.sock
This config working in others server, but this server I deploy filebeat on it cannot get docker metadata. I also use user root and grant all privilege to docker.sock folder.
Thanks in advance

2

dockerlogs? I'm not very expert in how the add_docker_metadata works but this seems very specific to your setup. Are you sure you it isn't a simple path typo or anything similar?

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.