MySQL (MariaDB) Overview dashboard empty

[castle9mm]

Hello, sorry for what's probably a basic beginner issue but my MySQL Overview dashboard in Kibana is empty. I'm trying to use Filebeat with AutoDiscover to capture the mysql error & slow query logs from a MariaDB container.

I think I have the autodiscover setup correctly since I can see general messages in the Discover page when I start/stop the mariadb container and also see access denied warnings as well.

In the container, i have slow queries logging properly to the local container /var/log/mysql/mariadb-slow.log file.

I'm assuming that I need to modify the filebeat/modules.d/mysql.yml file to adjust the slow log path but I'm unsure how to point it to the dynamic container.

filebeat.yml

filebeat.config:
  modules:
    path: ${path.config}/modules.d/*.yml
    reload.enabled: false

filebeat.prospectors:
- type: docker
  containers.ids:
    - '*'
  document_type: docker
  processors:
    - add_docker_metadata: ~

filebeat.autodiscover:
  providers:
    - type: docker
      templates:
        - condition:
            contains:
              docker.container.image: "mariadb"
          config:
            - module: mysql
              access:
                prospector:
                  type: docker
                  containers.ids:
                    - "${data.docker.container.id}"

processors:
- add_cloud_metadata:

output.elasticsearch:
  hosts: ['LB.ELK.rancher.internal:9200']

setup.kibana:
  host: "LB.ELK.rancher.internal:5601"

modules.d/mysql.yml

- module: mysql
  # Error logs
  error:
    enabled: true

    # Set custom paths for the log files. If left empty,
    # Filebeat will choose the paths depending on your OS.
    #var.paths:

  # Slow logs
  slowlog:
    enabled: true

    # Set custom paths for the log files. If left empty,
    # Filebeat will choose the paths depending on your OS.
    #var.paths: ["/var/log/mysql/mariadb-slow.log*"]

Any guidance would be super helpful as I'm feeling pretty stupid.

[exekias (Carlos Pérez Aradros)]

Hi @castle9mm,

I'm afraid there is not an easy way to get logs from a file inside the container, you have to do something special to gain access to them, these are some options:

• Update container command to include a tail to the log file you are interested in.
• Put the log file in a common volume, and use another container (sidecar) to read it. The sidecar can be Filebeat or just a tail (then you capture its stdout with Filebeat).

I would go with modifying MariaDB command to do also the tail. Hope this helps

Best regards