Metricbeat to monitor specific docker containers by name/image

Elastic Stack Beats
,
1

Hello everyone,

I am currently using Metricbeat to monitor my Docker containers and it is working well with my current configuration.

metricbeat.modules:
  - module: docker
    metricsets:
      - container
      - cpu
      - diskio
      - healthcheck
      - info
      #- image
      - memory
      - network
    hosts: [unix:///var/run/docker.sock]
    period: 10s
    enabled: true

However, I would like to make some customizations to allow Metricbeat to only monitor specific containers, either by container name or image name. I have attempted to make these changes to my configuration, but I am still encountering an issue where Metricbeat is monitoring all containers instead of just the specified ones.

metricbeat.modules:
  - module: docker
    metricsets:
      - container
      - cpu
      - diskio
      - healthcheck
      - info
      #- image
      - memory
      - network
    hosts: [unix:///var/run/docker.sock]
    period: 10s
    enabled: true
    containers.names:
        - name1
        - name2
        - name3
        - name4

Could anyone provide guidance or assistance on how to properly configure Metricbeat to monitor specific Docker containers? I would greatly appreciate any help or suggestions.

Thank you in advance!

2

Hello @Yungxin_Shin , you can use Drop Events processor (Drop events | Metricbeat Reference [8.6] | Elastic) in your metricbeat configuration (not in modules) and put a condition to NOT include required docker containers (If they are not many) or vice versa if containers to be dropped are less.

3

Hi @Ayush_Mathur, thanks for replying
I updated my config as below

processors:
  - add_cloud_metadata: ~
  - drop_event:
      when:
        and:
          - has_fields: ['container.name']
          - and:
              - not.contains:
                  container.name: name1
              - not.contains:
                  container.name: name2
              - not.contains:
                  container.name: name3
              - not.contains:
                  container.name: name4

Its currently working fine

However, I'm not sure if this config will mess up the default configurations of the docker module. It would be great if you could provide some advice or suggestion on this.

4

@Yungxin_Shin the docker module and processor configuration on metricbeat are 2 separate things. When you use a processor, it doesn't alter any behavior of any module. To be more precise, here are the steps that will be followed:

  1. Docker module polls the metrics and create an event with all the details.
  2. Metricbeat checks the configuration for any event manipulation before sending event for ingestion.. and voilla, your processor is found.
  3. drop_event processor is executed and conditions are checked on has_fields AND not.contains and decision is made to drop the event or not. AT this point, module has already completed its task of polling and creating the event -> so no messing up :slight_smile: .
  4. Once drop_event has made the decision, the event will or will not be sent for ingestion to your configured output.
5

Thanks for the clarification @Ayush_Mathur!

6

Happy to help :slight_smile:

7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.