[Filebeat] Using the System module while running Filebeat in docker

When running Filebeat as a docker container and using the System module in the filebeat.yml it requires access to the host's file system for reading from /var/logs/ (easy enough) but once the System module pulls the logs you must also use the processor "add_process_metadata" which the (Filebeat) container doesn't have access nor a configuration to the host's /proc (process ids) to get the syslog process.* details. Is this a known issue?

(more background) Metricbeat has overcome this issue with the "add_process_metadata" via use of the --system.hostfs configuration.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.