Filebeat autodiscover for docker does not work on /var/lib/docker/containers

trajano · December 14, 2018, 11:38pm

I have a similar issue, but I am new to setting this all up. Here's my filebeats.yml which I bake into the image

filebeat.config:
  modules:
    path: ${path.config}/modules.d/*.yml
    reload.enabled: false

filebeat.autodiscover:
  providers:
    - type: docker
      hints.enabled: true

processors:
  - drop_fields:
      fields:
        - "docker.containers.labels"
  - add_host_metadata: ~
  - add_cloud_metadata: ~

output.logstash:
  hosts: "${BEATS_HOST_PORT:log:5044}"
logging.level: warning

The drop fields was from Using AutoDiscover feature for Docker does not work when running in Swarm mode but that didn't work for me either.

My docker-compose file has the following service

  docker-beats:
    image: trajano.net/docker-beats
    volumes:
      - /var/lib/docker/containers:/var/lib/docker/containers:ro
      - /var/run/docker.sock:/var/run/docker.sock:ro
    deploy:
      mode: global

Unfortunately I just get all the logs with no real attribution except for the file beats server