I've just set up our ELK stack and I'm struggling with selecting the right containers for the autodiscover setting. I have a application consisting of around 20+ different containers. And around 10 of these containers have interesting logs I'd like to forward to Logstash.
filebeat.autodiscover: providers: - type: docker templates: - condition: contains: docker.container.image: **SOMETHING**
But, unfortunately, 'SOMETHING' covers a lot of containers. And I wanted to exclude some Docker containers. For example exclude container with the name 'SOMETHING/SOMETHING_ELSE'
I thought (and kinda hoped) this would work.
filebeat.autodiscover: providers: - type: docker templates: - condition: contains: docker.container.image: **SOMETHING** and.not.contains: docker.container.image: **SOMETHING_ELSE**
What is the correct syntax to exclude/include container images? Just being able to include more then 1 containername would be sufficient for now. Like;
contains: docker.container.image: **A**, **B**,**C**
Fyi; this is my first post here, I tried to use the right markdown and such, but please do correct me if I missed something
Filebeat version 6.4.1