Filebeat Kubernetes Autodiscovery Template Problem (6.5.4)

[Namik_Mesic]

I am trying to use filebeat kubernetes with autodiscovery and templates just as shown in the documentation, however I am unable to make the templates work.

What I am trying to achieve:

1. Send logs only when ceartain annotation is present in the pods.
2. Add log filtering (exclude_lines and include_lines) based on the kubernetes.container.image value.

Here is my daemonset:

spec:
  tolerations:
    - key: "node-role.kubernetes.io/master"
      effect: "NoSchedule"
      operator: "Exists"
  serviceAccountName: svc-logging
  terminationGracePeriodSeconds: 30
  containers:
  - name: filebeat
    image: docker.elastic.co/beats/filebeat:{{ .Values.filebeat.version }}
    args: [
      "-c", "/etc/filebeat.yml",
      "-e",
    ]
    env:
      - name: LOGSTASH_HOSTS
        value: "logstash:5044"
    securityContext:
      runAsUser: 0
    resources:
      limits:
        cpu: {{ .Values.filebeat.resources.limits.cpu }}
        memory: {{ .Values.filebeat.resources.limits.memory }}
      requests:
        cpu: {{ .Values.filebeat.resources.requests.cpu }}
        memory: {{ .Values.filebeat.resources.requests.memory }}
    volumeMounts:
    - name: config
      mountPath: /etc/filebeat.yml
      readOnly: true
      subPath: filebeat.yml
      readOnly: true
    - name: data
      mountPath: /usr/share/filebeat/data
    - name: varlibdockercontainers
      mountPath: /var/lib/docker/containers
      readOnly: true
  volumes:
  - name: config
    configMap:
      defaultMode: 0600
      name: filebeat-config
  - name: varlibdockercontainers
    hostPath:
      path: /var/lib/docker/containers
  # data folder stores a registry of read status for all files, so we don't send everything again on a Filebeat pod restart
  - name: data
    hostPath:
      path: /var/lib/filebeat-data
      type: DirectoryOrCreate

Here is the configuration I am using:

apiVersion: v1
kind: ConfigMap
metadata:
    name: filebeat-config
    labels:
        app: "{{ .Values.appName }}"
        component: filebeat
        chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
        release: {{ .Release.Name }}
data:
    filebeat.yml: |-
      filebeat.registry_flush: 1s

      filebeat.autodiscover:
        providers:
         - type: kubernetes
           hints.enabled: true
           include_annotations: ['logging']
           templates:
             - condition:
                contains:
                  kubernetes.container.image: "quay.io/hippo/user-worker"
               config:
                 - type: docker
                   container.ids:
                      - "${data.kubernetes.container.id}"
                   exclude_lines: ['^I0111']
      processors:
      - drop_event:
          when:
            not:
              equals:
                kubernetes.annotations.logging: 'true'

      output.logstash:
          hosts: '${LOGSTASH_HOSTS}'

Error I am getting is:
[filebeat-j5fbt] 2019-01-11T15:08:06.005Z ERROR [autodiscover] cfgfile/list.go:96 Error creating runner from config: Docker input requires at least one entry under 'containers.ids'

Can someone help me out , is there something I am doing wrong? I followed the documentation, or at least what I could find on the official website, and the forums and github.

I am using filebeats version 6.5.4

[exekias (Carlos Pérez Aradros)]

Hi @Namic_Mesic,

There is a typo in the config, it says container.ids where it should be containers.ids.

[Namik_Mesic]

@exekias Thanks a lot, I don't know how I missed that. Anyway, works like a charm now!