Hello, I deployed filebeat on kubernetes. I meet an proble with json on kibana message key. The configmap is
filebeat.yml: |-
setup.kibana:
host: "kibana.kube-system.svc.cluster.local:5601"
filebeat.inputs:
- type: docker
containers.ids: ""
containers.paths:
- /var/lib/docker/containers/{data.kubernetes.pod.uid}/{data.kubernetes.container.name}/.log
encoding: utf8
# exclude_lines: ['^ERR','^WARN']
# include_lines: ['^DBG']
json.keys_under_root: true
json.overwrite_keys: true
json.message_key: message
json.add_error_key: true
filebeat.config:
modules:
path: /usr/share/filebeat/modules.d/*.yml
reload.enabled: true
reload.period: 5m
processors:
# - add_cloud_metadata:
- add_kubernetes_metadata:
in_cluster: true
- decode_json_fields:
fields: ["docker"]
target: json
- drop_event:
when:
equals:
kubernetes.namespace: "kube-system"
- drop_event:
when:
equals:
stram: "stderr"
output.elasticsearch:
hosts: ["http://elasticsearch.kube-system.svc.cluster.local:9200"]
index: "${data.kubernetes.container.name}-%{+yyyy.MM.dd}"
On kibana dashboard shows bellow:
Could I can get the json fields?