PCF (CloudFoundry) Application rename is not being detected

[pausebreathefly (Anil)]

Hi,

We have configured the below processors in our filebeat application deployed on TAS or PCF but when we rename any application the changes are not being honored. Is there any additional setting that needs to be configured in the filebeat? Also where is the below cache stored ? how do we check the metadata that is being received ?

</ processors:

• add_cloudfoundry_metadata:
  <<: *cloudfoundry
  cache_duration: 1200s
  cache_retry_delay: 60s
  />

[stephenb (Stephen Brown)]

Hi @pausebreathefly Welcome to the community.

First a couple questions

• What version of TAS are you using?
• What version of Filebeat are you using?

I ask this because after a certain versions the add_cloudfoundry_metadata is no longer needed as the app names, spaces and org are available in the data stream directly and that is a much better method.

[pausebreathefly (Anil)]

@stephenb - Appreciate your quick reply. we are using TAS version of 2.10 and using Filebeat 7.13 .
Issue is we have a blue-green deployment on TAS and when the application gets renamed from blue to green. Its still shows old blue name.

[stephenb (Stephen Brown)]

Take out the add_cloudfoundry_metadata processor completely, It should be no longer needed.
Then re-push filebeat.
The app, org and space names should be realtime.
let me know what you see.

Here is what mine looks like with no processor

I renamed / restarted app

[stephenb (Stephen Brown)]

@pausebreathefly

Also here are my tuning parameters in the filebeat.yml for output if you are sending directly to elasticsearch

# Approach A : Tuning Parameters
queue.mem:
  events: 4096
  flush.min_events: 2048
  flush.timeout: 1s

output.elasticsearch:
  bulk_max_size: 200
  worker: 4

And here is my manifest.yml I found that 1GB filebeats with the above parameters are a good "scaling unit"

applications:
- name: filebeat
  memory: 1G
  instances: 2
  buildpacks:
  - binary_buildpack
  command: ./filebeat -e -c ~/filebeat.yml
  stack: cflinuxfs3
  health-check-type: process
  no-route: true