How to include specified docker containers in Filebeat?

Elastic Stack Beats
,
1

Hi All, I have a problem struggle some days and I find many Filebeat documents but I can't find the correct answer.

I want to make Filebeat only fetch the logs of the specified docker containers. I try the processor and autodiscover but both not work.

The processor type filebeat.yml :

filebeat.config:
  modules:
     path: ${path.config}/modules.d/*.yml
     reload.enabled: false
 
filebeat.autodiscover:
  providers:
    - type: docker
      hints.enabled: true
 
processors:
  - drop_event:
     when:
       or:
         - equals:
             docker.container.name: "foo"
         - equals:
             docker.container.name: "bar"

The autodiscover type filebeat.yml:

filebeat.config:
  modules:
    path: ${path.config}/modules.d/*.yml
    reload.enabled: false
 
filebeat.autodiscover:
  providers:
    - type: docker
      hints.enabled: true
      templates:
        - condition:
          equals:
              docker.container.name: "foo"
        - condition:
          equals:
              docker.container.name: "bar"
 
processors:
  - add_cloud_metadata: ~

Please help me to find a way to get the specified docker container logs. Thanks.

2

Anyone help?

3

Anybody?

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.