How to create container name specific indexes

Elastic Stack Logstash
1

I've deployed filebeat as a daemonset now for every container I need to access to their respective container names and read them from logstash so I can have indexes like 'container-name-YYYY-MM-DD' in my Elasticsearch.

These are my config files for both filebeat and logstash

filebeat.inputs:
- type: container
  stream: stdout
  paths:
    - /var/log/containers/*.log
  processors:
    - add_docker_metadata: ~
  #- add_kubernetes_metadata:
  #    host: ${NODE_NAME}
  #    matchers:
  #    - logs_path:
  #        logs_

output {
  elasticsearch {
  
    index => "%{[docker][container][name]}-%{+YYYY.MM.dd}"}}
2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.