Using 'traefik' module in combination with autodiscovery feature does not work as expected

Elastic Stack Beats
1

Hello,

I'm using filebeat in combination with the new autodiscovery feature for docker containers.
After some struggling (thank again @exekias!) I finally managed to get it to pick up and process the docker containers.

However, now that it's picking up the containers, the respective module configuration does not work as expected.

My configuration (taken pretty much straight from the manual):

  filebeat.autodiscover:
    providers:
      - type: docker
        templates:
          - condition:
              contains:
                docker.container.image: "traefik"
            config:
              - module: traefik
                access:
                  enabled: true
                  prospector:
                    type: docker
                    containers.ids:
                      - "${data.docker.container.id}"

In elasticsearch/kibana I do see the log messages, however unparsed. The field "filebeat.module" is set correctly to 'traefik' - however none of the traefik provided fields are populated, there is just the raw message in the 'message' field.

Any thoughts on how to fix this?

Thanks!

p.s. As an aside, I feel that the syntax to setup modules in combination with autodiscovery requires too much configuration compared to a regular module block.

1 Like
2

Seems this is a known issue 6111 which affects newer versions of Traefik.

Workaround is suggested in the issue (adjusting the provided grok patterns / pipeline).

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.