Here is my filebeat.yml
filebeat.autodiscover:
providers:
- type: docker
#hints.enabled: true
templates:
- condition:
contains:
docker.container.name: agent
config:
- type: docker
containers.ids:
- "${data.docker.container.id}"
processors:
- add_docker_metadata: ~
fields_under_root: true
multiline.pattern: '^\['
multiline.negate: true
multiline.match: after
- type: docker
#hints.enabled: true
templates:
- condition:
contains:
docker.container.name: tool
config:
- type: docker
containers.ids:
- "${data.docker.container.id}"
processors:
- add_docker_metadata: ~
fields_under_root: true
output.console:
pretty: true
When I use this config, filebeat ignores stdout from my discovered containers, but handles stderr lines. Setting containers.stream: "all" explicitly doesn't help either since it's default value for this option.
I discovered by accident, that adding hints.enabled: true to my providers fixes stdout logs handling. However, another problem arises: hints.enabled: true makes filebeat ignore my autodiscover configuration. With hints.enabled: true filebeat collects logs produced by all containers, not by ones specified in autodiscover templates. It even starts to collect logs produced by filebeat container itself, which makes it infinite loop of collecting events and logging information about it. So the questions are:
- How do I collect stdout logs if I want to keep using autodiscover?
- Why do hints work this way? Why enabling of hints implicitly changes behaviour of autodiscovery? Why Filebeat sends its own logs by default?