Filebeat ignores stdout logs with autodiscover of docker containers

Elastic Stack Beats
1

Here is my filebeat.yml

filebeat.autodiscover:
  providers:
    - type: docker
      #hints.enabled: true
      templates:
        - condition:
            contains:
              docker.container.name: agent
          config:
            - type: docker
              containers.ids:
                - "${data.docker.container.id}"
              processors:
              - add_docker_metadata: ~

              fields_under_root: true

              multiline.pattern: '^\['
              multiline.negate: true
              multiline.match: after

    - type: docker
      #hints.enabled: true
      templates:
        - condition:
            contains:
              docker.container.name: tool
          config:
            - type: docker
              containers.ids:
                - "${data.docker.container.id}"
              processors:
              - add_docker_metadata: ~

              fields_under_root: true

output.console:
  pretty: true

When I use this config, filebeat ignores stdout from my discovered containers, but handles stderr lines. Setting containers.stream: "all" explicitly doesn't help either since it's default value for this option.
I discovered by accident, that adding hints.enabled: true to my providers fixes stdout logs handling. However, another problem arises: hints.enabled: true makes filebeat ignore my autodiscover configuration. With hints.enabled: true filebeat collects logs produced by all containers, not by ones specified in autodiscover templates. It even starts to collect logs produced by filebeat container itself, which makes it infinite loop of collecting events and logging information about it. So the questions are:

  1. How do I collect stdout logs if I want to keep using autodiscover?
  2. Why do hints work this way? Why enabling of hints implicitly changes behaviour of autodiscovery? Why Filebeat sends its own logs by default?
1 Like
2

I have the same problem. Maybe someone knows workaround?

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.