Filebeat Autodiscover Docker ES7

Elastic Stack Beats
,
1

Hello,

Have a quick question in regards to Filebeat autodiscover for Docker. Traditionally we have deployed Filebeat on every node in our cluster to retrieve logs from Docker containers and send them to Logstash. This is not very practical as we have some nodes which do not need Filebeat. With the Filebeat autodiscover feature, will Filebeat automatically detect containers in my cluster and then send out the logs? For example, if I have an app container running on node 1, and Filebeat running on node 2. will Filebeat be able to detect the app container running on node 1 and send out logs?

Thank you,
Chris

2

Hi @cbille0,

That's possible, but not a straightforward scenario. Filebeat container module is configured to scrap the container log directory, so unless it is mounted at the node where filebeat runs, those won't be scrapped.

Adding docker metadata would also need to expose the docker endpoint to the host where filebeat runs.

3

Hello @pmercado,

Thank you for your response. Sounds like deploying Filebeat on every node, with the Docker container log directory, and the Docker endpoint mounted is the way to go.

Thank you,
Chris

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.