Filebeat + docker input - cannot drop events according to container name?

Elastic Stack Beats
1

I cannot for the life of me figure out why the following is not working:

This is using the elastic Filebeat 6.5.2 docker container:

filebeat.inputs:
- type: docker
  containers.ids: '*'
  combine_partial: true
  processors:
    - drop_event:
        when:
          equals:
            docker.container.name: "filebeat"

I literally want to not log anything related to the filebeat container. I've tried many combinations of getting an OR to work, using a regexp etc. but maybe someone can spot what I'm doing wrong with this simple example?

I expect the above to drop all log messages from the "filebeat" container.

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.