Filebeat kubernetes provider mixed logs another containers from same pod

Hi guys. May be anyone can check that?
Im using daemonset of filebeat 7.14.1 in openshift cluster with config

        - type: kubernetes
          include_pod_uid: true
          in_cluster: true
            - config:
                - type: container
                    - /var/log/pods/*_${data.kubernetes.pod.uid}/*/*.log

For temp storage using kafka cluster, then logstash cluster get logs from kafka and write to elastic.

Today i'm trying to find logs from container, which running in pod with 2 containers. And some times later found that logs had with name another container in that pod.
I'm checked with log.path.file. You can see that on screenshot.
How to fix that?

Hey @froheik,

With this autodiscover configuration all the containers in the same pod are going to generate the same configuration. Each configuration will include the metadata of the container generating the config, so it is possible that the input of one of these configurations is collecting all logs, and then including the metadata of this configuration.

You should include something that identifies the logs of a single container in the path pattern.

For example, try something like the following ones.

  • /var/log/containers/*-${}.log
  • /var/log/pods/*_${data.kubernetes.pod.uid}/${}/*.log

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.