Filebeat and deleted files

Elastic Stack Beats
1

Hi,

I have a problem with filebeat and deleted files.
I don't scrape /var/lib/docker/containers//.log path

But when docker do rollup of file logs, the daemon delete file /var/lib/docker/containers//.log.9, then filebeat retain this file and I have problem with disk space in /var/lib/docker.

I don't understand why filebeat use /var/lib/docker/containers//.log? , if I don't use it.
This is my filebeat configuration:

thanks.

filebeat.inputs:
- type: log
paths:
  - /opt/kubernetes/audit/apiserver.log
json.message_key: log
tags: ["audit"]

filebeat.autodiscover:
providers:
  - type: kubernetes
	node: ${NODE_NAME}
	hints.enabled: true
	# Default config hints is enable. You can use annotations to pod level
	hints.default_config:
	  type: container
	  paths:
		- "/var/log/containers/*${data.kubernetes.container.id}.log"
	  multiline:
		pattern: '^[[:space:]]+(at|.{3})|^Caused by:|^java'	
		negate: false
		match: after

processors:
- add_docker_metadata:

- drop_event:
  when.or:
  - regexp:
	  kubernetes.namespace: "^${NAMESPACE}*"
2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.