Nginx module on k8s - access and error from the same path?

Elastic Stack Beats
, ,
1

Hey,

So I have a micro service with nginx, I am using filebeat nginx module to read the logs:

      filebeat.autodiscover:
        providers:
          - type: kubernetes
            hints.enabled: true
            templates:
              - condition.or:
                  - equals:
                      kubernetes.deployment.name: service1
                  - equals:
                      kubernetes.deployment.name: service2
                config:
                  - module: nginx
                    access:
                      input:
                        type: container
                        containers.ids:
                          - "${data.kubernetes.container.id}"
                        paths:
                        - /var/lib/docker/containers/${data.kubernetes.container.id}/*.log
                    error:
                      input:
                        type: container
                        containers.ids:
                          - "${data.kubernetes.container.id}"
                        paths:
                        - /var/lib/docker/containers/${data.kubernetes.container.id}/*.log
                    ingress_controller:
                      input:
                        type: container
                        containers.ids:
                          - "${data.kubernetes.container.id}"
                        paths:
                        - /var/lib/docker/containers/${data.kubernetes.container.id}/*.log

Now the issue is that I get 3 logs in kibana for every log on service1 & 2.
Anyone have solution for this one?
I can simply use filter on kibana saying error.message does not exists in filter, but any way to drop the message before it arrive to ES?

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.