I started ingesting Kubernetes logs into ElasticSearch, using the Filebeat Input Container:
Filebeat -> Logstash -> ElasticSearch
My filebeat.yml
looks like this:
- type: container
paths:
- /var/lib/docker/containers/*/*.log
fields:
logs_type: "k8s"
fields_under_root: true
multiline.type: pattern
multiline.pattern: '^[[:space:]]+(at|\.{3})[[:space:]]+\b|^Caused by:'
multiline.negate: false
multiline.match: after
processors:
- add_docker_metadata:
host: "unix:///var/run/docker.sock"
output:
logstash:
enabled: True
hosts:
- logstash1:5043
- logstash2:5043
loadbalance: true
How can I format a Kibana URL to show logs for a specific field name? For example: container.labels.io_kubernetes_container_name
= my-k8s-app
http://kibana:5601/app/discover#/?_g=()&options=(container.labels.io_kubernetes_container_name:"my-k8s-app")