Logstash cannot use docker metadata to build a dynamic index

I use filebeat to collect docker logs and add a label when the docker container starts.
1

- type: docker
  enabled: true
  containers.ids:
    - '*'  
  tail_files: true

The following configuration is made in logstash to build a dynamic index.

filter {
     json {
       source => "message"
   }
}

output {
    elasticsearch {
        hosts => ["192.168.6.155:9200","192.168.6.156:9200","192.168.6.157:9200"]
        ssl => true
        cacert => "/etc/logstash/ssl/root.pem"
        index => "%{[container.labels.service]}-%{+YYYY.MM.dd}"
    }
}

But I failed and got the following index

2

You should use [container][labels][service] and not [container.labels.service].

Try to change the index option in your output to this:

index => "%{[container][labels][service]}-%{+YYYY.MM.dd}"

I tried to follow your example, and I got the following results:

%{[container][labels][service]}-2021.04.23

After many tests, I solved the problem, it needs to meet some conditions. Thank you very much for your help

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.