Filebeat hint based autodiscovery not working

Elastic Stack Beats
1

I have filebeat 6.3.2 installed in kubernetes cluster as daemonset.

Configs are at https://gist.github.com/ITBlogger/f50632d643ec4cb241bdd41355b295ba#file-filebeat-configmaps and deployment snippet is at https://gist.github.com/ITBlogger/f50632d643ec4cb241bdd41355b295ba#file-k8s-deploy-snippet

Logs are making it to elk cluster just fine (addresses in the gist are redacted), but not getting sent via the nginx module, nor are the proper lines being excluded.

There's nothing in the filebeat logs to suggest that things aren't working.

Should also mention that annotations are not being sent to logstash/elasticsearch as they should either.

I seem to be missing something, but not sure what.

Thanks in advance for your help.

[PS] This has been solved...gists have been updated with the correct configs. Also see http://itmanager.blogs.com/notes/2018/08/using-filebeat-hint-based-autodiscover-with-kubernetes.html

Alex

2

Bump, I'm having exactly same issue. Multiline hints are not working either.

1 Like
3

OK, I updated the config gist, because I realized after reading through the docs that the docker input isn't required with autodiscover...

Hints are still not working though.

4

@exekias helped me figure out the issues.

Correct working setup is in the gists.

5

@Alex_Scoble thanks for the update, adding include_annotations: '*' did the trick.

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.