Filebeat config using Docker labels as index and pipeline names

Elastic Stack Beats
,
1

I am trying to use docker labels as the index and pipeline names. What is wrong with this config?

filebeat.config:
  modules:
    path: ${path.config}/modules.d/*.yml
    reload.enabled: false

filebeat.autodiscover:
  providers:
    - type: docker
      hints.enabled: true
      hints.default_config.enabled: false

processors:
- add_cloud_metadata: ~

cloud.id: '${cloud.id}'
cloud.auth: '${cloud.auth}'

output.elasticsearch:
  pipelines:
    - pipeline: "%{[fields.docker.container.labels.co_elastic_logs/pipeline]}"
      when.equals:
        fields.docker.container.labels.co_elastic_logs/enabled: "true"
  indices:
    - index: "%{[fields.docker.container.labels.co_elastic_logs/index]}-%{+yyyy.MM.dd}"
      when.equals:
        fields.docker.container.labels.co_elastic_logs/enabled: "true"

setup.ilm.enabled: false
2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.