MongoDB module error

[szaharici]

Hey guys,

I am trying to use the mongodb filebeat module to parse the logs from mongodb instances running under kubernetes.
Filebeat is deployed with the elastic-stack helm chart, here is the configuration:

filebeat:
 enabled: true
 config:
  filebeat.autodiscover:
     providers:
       - type: kubernetes
         templates:
           - condition.equals:
               kubernetes.labels.app: mongo
             config:
               - module: mongodb
                 enabled: true
                 log:
                   input:
                     type: docker
                     containers.ids:
                       - $${data.kubernetes.container.id}
  output.file:
    enabled: false
  output.elasticsearch:
    hosts: [http://elk-elasticsearch-client:9200]
    enabled: true

It is working fine on one of the clusters, however on a second one the filebeat containers are erroring out:

elk-filebeat-fqrwm filebeat 2020-07-06T22:27:58.231Z ERROR [autodiscover] cfgfile/list.go:96 Error creating runner from config: Error unpacking module config: error unpacking module mongodb in a dict: missing field accessing 'log'

Any idea what could cause this ?
Thanks a lot

[szaharici]

So the issue was related to the additional $ in $${data.kubernetes.container.id}. In one case it was used in a terraform template in the other it was just a config file