My Elastic stack version is at 6.0.0;
ELK + Filebeat + Metricbeat running in docker swarm mode;
Docker host machines are all ubuntu/xenial64.
I have configured filebeat as described in this blog by Carlos Pérez-Aradros: https://www.elastic.co/blog/enrich-docker-logs-with-filebeat which works fine and I can see data in Kibana.
filebeat.prospectors: - type: log paths: - '/var/lib/docker/containers/*/*.log' json.message_key: log json.keys_under_root: true processors: - add_docker_metadata: ~ output.elasticsearch: hosts: ["elasticsearch:9200"]
Now, has anyone tried getting filebeat working on "docker for AWS (CE)"? '/var/lib/docker/containers' can not be mounted and so filebeat fails to start.
On any node in "Docker for AWS", I get this error:
- ls: cannot access /var/lib/docker/containers: No such file or directory
for anyone who would like to try, here are my docker compose and filebeat.yml files
I will be grateful if anyone give us a shout if they have got filebeat working on "Docker for AWS"