When using Filebeat to collect container logs, I noticed that the logs from the container's standard output at startup do not include certain Kubernetes metadata fields (e.g., pod name, image ID). These fields only appear in logs generated tens of seconds after the container starts running. I suspect this happens because Filebeat hasn't had enough time to retrieve the pod's metadata when it first launches. My Filebeat version is 7.6.2. How can I resolve this issue?
my app deployment yaml:
apiVersion: apps/v1
kind: Deployment
metadata:
name: go-app
spec:
replicas: 1
selector:
matchLabels:
app: go-app
template:
metadata:
labels:
app: go-app
spec:
containers:
- name: go-app
image: my-go-app:latest
imagePullPolicy: IfNotPresent
command: ["./myapp"]
ports:
- containerPort: 18181
env:
- name: POD_NAME
valueFrom:
fieldRef:
fieldPath: metadata.name
my filebeat conf yaml:
apiVersion: v1
data:
filebeat.yml: |
filebeat.inputs:
- type: container
paths:
- /var/lib/docker/containers/*/*.log # docker 容器路径， containerd 需更改
scan_frequency: 1s
max_bytes: 10485760
processors:
- add_kubernetes_metadata:
host: ${NODE_NAME}
matchers:
- logs_path:
logs_path: "/var/lib/docker/containers"
filebeat.spool_size: 250000
filebeat.idle_timeout: 1s
max_procs: 36
queue.mem:
events: 409600
flush.min_events: 512
flush.timeout: 1s
logging.level: error
setup.template.enabled: false
setup.template.overwrite: false
setup.template.name: "dg-stdout" # 修改名称
setup.template.pattern: "dg-stdout-*"
setup.ilm.enabled: true
setup.ilm.rollover_alias: "dg-stdout"
setup.ilm.pattern: "{now/d}-000001"
setup.ilm.policy_name: aipaas-stdout-policy
output.elasticsearch:
hosts: ["http://32.11.13.19:1001"]
kind: ConfigMap
metadata:
labels:
k8s-app: filebeat
name: filebeat-config
