Kubernetes custom pipeline processing

Elastic Stack Beats
1

In pod following annotations mentioned but pipeline is not processing.

      annotations:
        co.elastic.logs/enabled: 'true'
        co.elastic.logs/fileset: syslog
        co.elastic.logs/module: system
        co.elastic.logs/pipeline: filebeat-kube-java-logs

Filebeat daemonset configuration

  filebeat.yml: |-
    filebeat.autodiscover: 
      providers:
        - type: kubernetes
          hints.enabled: true
          hints.default_config:
            type: container
            paths:
              - /var/log/containers/*-${data.kubernetes.container.id}.log
          templates:
            - condition:
                equals:
                  kubernetes.namespace: "jboss-eap-test1"
              config:
                - type: container
                  paths:
                    - /var/log/containers/*-${data.kubernetes.container.id}.log
                  pipeline: filebeat-eis-java-logs

    processors:
      - add_cloud_metadata:
      - add_host_metadata:
      - add_kubernetes_metadata:

The pod is processed by hint based autodiscover. I had checked the multiline annotations that's also working only pipeline not working.

2

What version?

Are you sure the pipeline is not running or is it perhaps failing?.

What I always do is just create a pipeline with a simple set field to see if it's running or not.

I'm also confused because you said you checked multi-line but I don't see anything from multiline so I'm not really clear.

It is also not clear whether you mean just the one on the top is not running or your default template is not running or both?

3

I am using the version of 7.16.0 of filebeat version. While i was troubleshooting i had enabled the multiline pattern annotations to check and eliminate the annotations indeed picked up by hint based autodiscover. It worked so i removed multiline annotations from pod config ...

  1. Checked pipeline passing through the template . it's not working .
  2. Checked the pipeline passing through the annotations . it's not working.

Pipeline

PUT _ingest/pipeline/filebeat-kube-java-logs
{
    "description" : "Java EIS logs",
    "processors" : [
{
  "set": {
    "field": "kubetext",
    "value": "i'm ok"
  }
}
    ]
  }
4

Hi @Vijayakumar_Kannan

Hmm I am taking a look may take a little while to get back.

5

@Vijayakumar_Kannan

Found it... pipeline hint was not introduced until 8.1 you are on 7.16 really important to look at the right docs version.

You will see in 7.16 that the pipeline hint is not available.

Took me a while to figure it out. I tried 8.1+ and it works....

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.