# Filebeat Autodiscovery: Filtering by container labels **URL:** \ **Category:** Beats\ **Tags:** filebeat\ **Created:** [February 16, 2018, 2:48pm UTC](https://discuss.elastic.co/t/filebeat-autodiscovery-filtering-by-container-labels/120201 "2018-02-16T14:48:42Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![ppik](https://avatars.discourse-cdn.com/v4/letter/p/90db22/32.png) [@ppik](https://discuss.elastic.co/u/ppik)\ **Post date:** [February 16, 2018, 2:48pm UTC](https://discuss.elastic.co/t/filebeat-autodiscovery-filtering-by-container-labels/120201/1 "2018-02-16T14:48:42Z")
Hi, I would like to set up Filebeat configuration with docker autodiscovery provider to create prospectors only for docker containers with certain label, e.g., `filebeat.enable: "true"`. However I find it difficult to find the correct condition format to achieve this. I have tried the following config, but it does not seem to match any docker events: ``` filebeat.autodiscover: providers: - type: docker templates: - condition: equals: docker.container.labels.filebeat.enable: "true" config: - type: docker containers.ids: - "${data.docker.container.id}" ``` That is, I see the following in the filebeat log: ``` 2018-02-16T14:24:26.330Z DEBUG [docker] docker/watcher.go:207 Got a new docker event: {create 93d527f6de152c3735a19517a84f444644cdd1d2fb16c11aaae202d40ffea8b3 local/hello:dev container create {93d527f6de152c3735a19517a84f444644cdd1d2fb16c11aaae202d40ffea8b3 map[com.docker.compose.version:1.18.0 image:local/hello:dev maintainer:NGINX Docker Maintainers name:api_hello_1 com.docker.compose.container-number:1 com.docker.compose.project:api com.docker.compose.service:hello filebeat.enable:true com.docker.compose.config-hash:57c6c7591874f57f02a64297c36cc71e96085fa3c690170bd7cd75e9a42a34ad com.docker.compose.oneoff:False]} local 1518791066 1518791066330127148} ``` But it does not trigger autodiscover start event as can be seen with filtering based on `docker.container.name` as in the documentation example. Could anyone help me out with the correct condition format for `docker.container.labels`? ---
**Author:** ![exekias](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/exekias/32/28718_2.png) [@exekias](https://discuss.elastic.co/u/exekias)\ **Post date:** [February 17, 2018, 1:08pm UTC](https://discuss.elastic.co/t/filebeat-autodiscovery-filtering-by-container-labels/120201/2 "2018-02-17T13:08:34Z")
Hi @ppik, Could you try to use a label without dots on it? I think there is an issue with labels containing dots at the moment. We saw something similar in the Kubernetes provider and fixed it. Best regards ---
**Author:** ![ppik](https://avatars.discourse-cdn.com/v4/letter/p/90db22/32.png) [@ppik](https://discuss.elastic.co/u/ppik)\ **Post date:** [February 17, 2018, 7:01pm UTC](https://discuss.elastic.co/t/filebeat-autodiscovery-filtering-by-container-labels/120201/3 "2018-02-17T19:01:14Z")
Hi @exekias, Thank you for the suggestion. Unfortunately it doesn't help if I remove the dot from the filebeat config above, the started docker containers with the right labels seem to be left undiscovered. Tried also contains and regexp matchers, but with no luck. ---
**Author:** ![exekias](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/exekias/32/28718_2.png) [@exekias](https://discuss.elastic.co/u/exekias)\ **Post date:** [February 19, 2018, 12:52am UTC](https://discuss.elastic.co/t/filebeat-autodiscovery-filtering-by-container-labels/120201/4 "2018-02-19T00:52:52Z")
Sorry, I meant removing the dot both from the label and the config. Dots are not supported as of today, we are working on a fix for this 🙂 ---
**Author:** ![ppik](https://avatars.discourse-cdn.com/v4/letter/p/90db22/32.png) [@ppik](https://discuss.elastic.co/u/ppik)\ **Post date:** [February 19, 2018, 8:18am UTC](https://discuss.elastic.co/t/filebeat-autodiscovery-filtering-by-container-labels/120201/5 "2018-02-19T08:18:59Z")
Thanks for the clarification. For the minimal configuration I have something like this, currently: `filebeat.yml` ```auto filebeat.autodiscover: providers: - type: docker templates: - condition: contains: docker.container.labels.somelabel: "somevalue" config: - type: docker containers.ids: - "${data.docker.container.id}" output.console: pretty: true ``` and i start it with the following `docker-compose.yml`: ```auto version: '3' services: filebeat: image: docker.elastic.co/beats/filebeat:6.2.1 command: "--strict.perms=false -v -e -d autodiscover,docker" user: root volumes: - ./filebeat.yml:/usr/share/filebeat/filebeat.yml - /var/lib/docker/containers:/var/lib/docker/containers - /var/run/docker.sock:/var/run/docker.sock test: image: alpine command: "sh -c 'while true; do echo test; sleep 1; done'" depends_on: - filebeat labels: somelabel: "somevalue" ``` Docker events can be seen by the filebeat, but the autodiscovery seems to miss the condition. ---
**Author:** ![exekias](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/exekias/32/28718_2.png) [@exekias](https://discuss.elastic.co/u/exekias)\ **Post date:** [February 19, 2018, 3:15pm UTC](https://discuss.elastic.co/t/filebeat-autodiscovery-filtering-by-container-labels/120201/6 "2018-02-19T15:15:32Z")
Hi again, Thank you for the testing files, they helped me reproducing this issue. I'm afraid you found a bug, the good news is that I have a working fix that should go in soon, here you have the code change so you can follow it's release or build your own image: [https://github.com/elastic/beats/pull/6412](https://github.com/elastic/beats/pull/6412) Thank you! Best regards ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [March 19, 2018, 3:15pm UTC](https://discuss.elastic.co/t/filebeat-autodiscovery-filtering-by-container-labels/120201/7 "2018-03-19T15:15:47Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.