Not reading /var/lib/docker/containers?

Elastic Stack Beats
1

Am hoping to use filebeat to get stdout from my containers running on kubernetes. So far no luck here.

Looking at filesystem on kubernetes hosts I see that /var/lib/docker/containers has permissions only for root

drwx------    4 root root

Is it possible that this is preventing filebeat from accessing the logs contained inside those folders?

2

In kubernetes we normally run filebeat as a daemon-set + mount in /var/lib/docker/containers, so filebeat is somewhat isolated and can read the logs.

If filebeat is not running as root, but files are root only, the it's a permissions problem.

Also see docs
and default deployment configs for filebeat as kubernetes daemonset.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.