Problem getting autodiscover docker to work with filebeat

Elastic Stack Beats
11

OK, in the end I have it working correctly using both filebeat.autodiscover and filebeat.inputs and I think that both are needed to get the docker container logs processed properly. I wish this was documented better, but hopefully someone can find this and it helps them out. I still don't know if this is 100% correct, but I'm getting all the docker container logs now with metadata.

Thanks @kvch for your help and responses!

filebeat.autodiscover:
# Autodiscover docker containers and parse logs
  providers:
    - type: docker
      templates:
          config:
            - type: docker
              containers.ids:
                - "${data.docker.container.id}"
              exclude_lines: ["^\\s+[\\-`('.|_]"]  # drop asciiart lines
              
filebeat.inputs:
  - type: docker
    containers.ids:
      - "*"
    processors:
      - add_docker_metadata:
2 Likes