How to use Filebeat Traefik module with Docker?

Elastic Stack Beats
, ,
1

I am using Filebeat with Docker autodiscover. I added the Filebeat Traefik module to the config and it works fine when parsing access logs from the filesystem. My challenge is that Traefik does not do log roll-over.

filebeat.config:
  modules:
    path: ${path.config}/modules.d/*.yml
    reload.enabled: false

filebeat.autodiscover:
  providers:
    - type: docker
      hints.enabled: true

processors:
- add_cloud_metadata: ~

output.elasticsearch:
  hosts: '${ELASTICSEARCH_HOSTS:elasticsearch:9200}'
  username: '${ELASTICSEARCH_USERNAME:}'
  password: '${ELASTICSEARCH_PASSWORD:}'

filebeat.modules:
  - module: traefik
    access:
      enabled: true
      var.paths: ["/var/log/traefik/access.log*"]

1] I would like to have Traefik use stdout/stderr for logs, which Filebeat recognizes as plain text. How can I enable the Traefik access parsing module on the container output? Just removing var.paths does not seem to work.

2] Traefik also creates some internal messages which the Traefik parser labels as failed to find message because it does not fit the format. Is there an option to still keep the data instead of just an error?

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.