Filebeat autodiscoverkubernetes

Elastic Stack Beats
1

reference Filebeat kubernetes autodiscover Multiple conditions

The problem is When the condition has “kubernetes.labels.log-index” ，fields:log_topic: 'labels-{data.kubernetes.labels.log-index}', otherwise fields: log_topic: 'aip-{data.kubernetes.namespace}-${data.kubernetes.pod.name}'
The default condition not.equals.kubernetes.container.name: "filebeat" 。

Currently in use appenders ，But error is ERROR instance/beat.go:691 Exiting: unknown autodiscover appender config
Reference : Filebeat autodiscovery appenders , But there are still ERROR instance/beat.go:691 Exiting: unknown

filebeat run kubernetes daemonset.
filebeat docker image
docker.elastic.co/beats/filebeat:6.5.4
or
docker.elastic.co/beats/filebeat-oss:6.5.3

filebeat.yaml

  filebeat.autodiscover:
    providers:
      - type: kubernetes
        hints.enabled: true
        templates:
          - condition.and:
              - not.has_fields: ['kubernetes.labels.log-index']
              - not.equals.kubernetes.container.name: "filebeat"
            config:
              - type: docker
                containers.ids:
                  - "${data.kubernetes.container.id}"
                exclude_lines: ["^\\s+[\\-`('.|_]"]  # drop asciiart lines
                fields:
                  log_topic: 'aip-${data.kubernetes.namespace}-${data.kubernetes.pod.name}'
        appenders:
          - type: config
            condition.and:                      
              - has_fields: ['kubernetes.labels.log-index']
              - not.equals.kubernetes.container.name: "filebeat"        
            config:
              fields:
                log_topic: 'labels-${data.kubernetes.labels.log-index}'
2

This looks like a bug. To me it looks like the config appender is not compiled into filebeat. Please open a bug report

3

@ steffens
Has been submitted ，Thank you

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.