Filebeat log path on Kubernetes

Elastic Stack Beats
,
1

I am using the filebeat on kubernetes with autodiscover. In the default filebeat-config configmap the input path is /var/log/containers/*${data.kubernetes.container.id}.log. In the Running Filebeat on Kubernetes documentation it references the " Docker logs host folder ( /var/lib/docker/containers )".

My question is which is ultimately correct? Yes the /var/log/containers/*{data.kubernetes.container.id}.log is a link to /var/lib/docker/containers but should the ConfigMap point directly to /var/lib/docker/containers with something like /var/lib/docker/containers/{data.kubernetes.container.id}/${data.kubernetes.container.id}.log* to ensure we capture the end of logs that roll where those are not visible via the link file in the default ConfigMap? How does filebeat handle kubernetes container log rolls?

Thanks for any insight on this in advance.

-Matt

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.