Hi,
I have deployed Metricbeat and Auditbeat (7.1.0-SNAPSHOT) as a daemonSet on a k8s cluster, the container Metricbeat module is reporting the info of an event related to Auditbeat daemonSet and it fails to store the data on Elasticsearch with a mapping error
"org.elasticsearch.index.mapper.MapperParsingException: failed to parse field [docker.container.ip_addresses] of type [ip] in document with id '4ARYWWkBTidYNB1MYom3'","at org.elasticsearch.index.mapper.FieldMapper.parse(FieldMapper.java:280) ~[elasticsearch-7.1.0-SNAPSHOT.jar:7.1.0-SNAPSHOT]","at
This is the JSON message, the IP is empty so it is not an IP ("ip_addresses": [""],), as a workaround I have disabled the containers module on the docker.yml file.
{
[metricbeat - 7.1 .0][_doc][4 ARYWWkBTidYNB1MYom3], source[{
"@timestamp": "2019-03-07T18:08:00.214Z",
"docker": {
"container": {
"labels": {
"io_kubernetes_docker_type": "podsandbox",
"annotation_kubernetes_io/config_seen": "2019-03-07T18:05:52.183452515Z",
"annotation_kubernetes_io/config_source": "api",
"io_kubernetes_pod_namespace": "kube-system",
"pod-template-generation": "1",
"io_kubernetes_container_name": "POD",
"io_kubernetes_pod_name": "auditbeat-w7j9j",
"k8s-app": "auditbeat",
"controller-revision-hash": "1545459614",
"io_kubernetes_pod_uid": "a5145dea-4103-11e9-b1d6-42010a8401a4"
},
"image": "k8s.gcr.io/pause-amd64:3.1",
"status": "Up 2 minutes",
"id": "06e88f74f9455c64af63e503dc85be6ad25c1b8d728b8d230049dee53bc6ff6d",
"name": "k8s_POD_auditbeat-w7j9j_kube-system_a5145dea-4103-11e9-b1d6-42010a8401a4_0",
"ip_addresses": [""],
"size": {
"rw": 0,
"root_fs": 0
},
"created": "2019-03-07T18:05:52.000Z",
"command": "/pause"
}
},
"event": {
"duration": 15917699,
"dataset": "docker.container",
"module": "docker"
},
"host": {
"hostname": "gke-XXXXXXXXXX-pool-1-c6a5cd7f-ggzj",
"architecture": "x86_64",
"os": {
"platform": "centos",
"version": "7 (Core)",
"family": "redhat",
"name": "CentOS Linux",
"kernel": "4.14.65+",
"codename": "Core"
},
"containerized": true,
"name": "gke-XXXXXXXXXX-pool-1-c6a5cd7f-ggzj"
},
"ecs": {
"version": "1.0.0-beta2"
},
"agent": {
"id": "70b22ecd-18ee-43ff-9bc5-a53433d68d11",
"version": "7.1.0",
"type": "metricbeat",
"ephemeral_id": "81b25b3a-55ac-44cd-b77c-b59872c3dea8",
"hostname": "gke-XXXXXXXXXX-pool-1-c6a5cd7f-ggzj"
},
"cloud": {
"machine": {
"type": "projects/XXXXXXXXXX/machineTypes/n1-standard-2"
},
"availability_zone": "projects/XXXXXXXXXX/zones/europe-west1-c",
"instance": {
"id": "7177843840848088616",
"name": "gke-XXXXXXXXXX-pool-1-c6a5cd7f-ggzj"
},
"project": {
"id": "XXXXXXXXXX"
},
"provider": "gce"
},
"metricset": {
"name": "container"
},
"service": {
"address": "/var/run/docker.sock",
"type": "docker"
}
}]
}