Filebeat autodiscovery appenders

Elastic Stack Beats
1

Hi there,

I am using filebeat with autodiscovery and would like to use appenders. However the appender config is not being applied. This is my filebeat.yml config.

filebeat.autodiscover:
  providers:
    - type: kubernetes
      templates:
        - condition:
            equals:
              kubernetes.namespace: default
          config:
            - type: docker
              containers.ids:
                - "${data.kubernetes.container.id}"
  appenders:
    - type: config
      condition.equals:
        kubernetes.container.name: "spring-boot"
      config:
        tags: ["spring"]

output.logstash:
  hosts: ["192.168.16.119:5044"]

Thanks for any help.
Nick

2

It appears that the indentation is wrong, appenders should be at the same level as templates.

So the docs at https://www.elastic.co/guide/en/beats/filebeat/6.3/configuration-autodiscover-advanced.html#_appenders are also wrong. Could you please open a new Github issue for the documentation.

3

I will. Thanks for your help.

4

Hello,

Now i get this error:

2018-08-02T09:31:12.703Z ERROR instance/beat.go:691 Exiting: unknown autodiscover appender config

With the following config.

filebeat.autodiscover:
  providers:
    - type: kubernetes
      templates:
        - condition:
            equals:
              kubernetes.namespace: default
          config:
            - type: docker
              containers.ids:
                - "${data.kubernetes.container.id}"
      appenders:
        - type: config
          condition.equals:
              kubernetes.container.name: "spring-boot"
          config:
            tags: ["spring"]

output.logstash:
  hosts: ["192.168.16.119:5044"]

Any ideas?

Thank you,
Nick

5

Hi @Nick_Carn,

What version of Filebeat are you using? config appender was introduced in version 6.3

6

Hi @exekias,

I am using 6.3.1

root@vpm-filebeat-w4k8h:/# /opt/filebeat/filebeat version
filebeat version 6.3.1 (amd64), libbeat 6.3.1 [ed42bb85e72ae58cc09748dc1825159713e0ffd4 built 2018-06-29 21:09:35 +0000 UTC]

7

This looks like a bug, could you please open a new bug report? I will have a look to it: https://github.com/elastic/beats/issues

8

Sorry for the inconvenience, I went ahead and opened a fix for this: https://github.com/elastic/beats/pull/7846

9

Cool thanks

10

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.