Multiple container in single filebeat.autodiscover

Elastic Stack Beats
1

HI,
I have configured filebeat.autodiscover for docker container log analysis, I have 8 docker containers and I want to add few containers in filebeat, below code is working fine for one image ,

filebeat.autodiscover:
providers:
- type: docker
templates:
- condition:
equals.docker.container.image: ucc/header-api:0.9
config:
- type: log
paths:
- /VMWNODE/docker/containers/${data.docker.container.id}/*.log
fields:
environment: Development
fields_under_root: true

          multiline.pattern: '^[[:space:]]+|]$'
          multiline.match: after

I have tried below few conditions but it's not working, so can you please suggest correct systex :-

  1. as mentioned in "Multiple conditions with autodiscover & docker containers"
  • condition.and:
    contains:
    docker.container.image: ucc
    contains:
    docker.container.image: swaggerapi
  • condition.or:
    - contains.docker.container.name: "apache"
    - contains.docker.container.name: "nginx"

please suggest correct code to monitor multiple container

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.