Filebeat docker container labels do not seems

Elastic Stack Beats
,
1

Hi all,

I use filebeat and logstash for store my all datas. My docker setup and log files are in /home/docker/containers folder. (not in /var/lib/docker path)

The problem is when i was colleting my logs, the docker fields are not shown. (Such as; container.labels.com_docker_swarm_service_name,container.labels.com_docker_swarm_task_name,container.labels.org_label-schema_name,container.labels.org_label-schema_schema-version, container.name,container.image.name etc).

How can I see these fieds ?

My filebeat version is 7.1.1 and also my filebeat.yml as following.

  filebeat.autodiscover:
    providers:
      - type: docker
        templates:
          config:
            - type: docker
              containers.ids:
                - "${data.docker.container.id}"

filebeat.inputs:
  #------------------------------ Docker input --------------------------------
  - type: docker
    enabled: true
    encoding: "utf-8"
    containers:
      path: "/home/docker/containers"
      ids:
        - "*"
    multiline.pattern: '^\[[0-9]{4}-[0-9]{2}-[0-9]{2}'
    multiline.negate: true
    multiline.match: after
    exclude_lines: ["^\\s+[\\-`('.|_]"]  # drop asciiart lines
    processors:
      - add_host_metadata: ~
      - add_docker_metadata: ~

#=========================== Filebeat inputs ==============================

output.logstash:
  hosts: ["logstash:5044"]
2

Hi!

docker input is deprecated so I would suggest you switching to container input .

C.

4

Can I see docker container labels in container input ?

In other words, can I add docker metadata with input type container to filebeat ?

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.