E
E
EmachinesDIMA2022-02-08 11:36:42
elasticsearch
EmachinesDIMA, 2022-02-08 11:36:42

How to make filebeat listen only to certain docker containers?

I use container autodiscovery:
filebeat.autodiscover:
providers:
- type: docker
labels.dedot: true
hints.enabled: true

filter works if you specify
condition.container.labels.collect_logs_with_filebeat: "true"

and add a label to the container whose container logs I want get:
labels:
co.elastic.logs/enabled: "true" # for Filebeat
collect_logs_with_filebeat: "true"

———————————————————-
but what if there are hundreds of containers and Are you going to add tags to everyone?

Rule:
condition.docker.container.name: "container name" - doesn't work.

——————————-
the above applies to the configuration of filebeat running both locally and in a container.

If you run filebeat in a container and define it in an isolated docker.networks (external) - along with the container whose container logs I want to receive - - it ignores this and listens to all containers - hints listen to all containers on the host.

Here is the dilemma - to suffer and add labels "listen or not listen" to their filebeat to all containers, or still how to be able to configure templates: for container filtering.

Answer the question

In order to leave comments, you need to log in

2 answer(s)
E
EmachinesDIMA, 2022-02-08
@EmachinesDIMA

filebeat.autodiscover:
providers:
- type: docker
hints.enabled: true
hints.default_config.enabled: false
and add
labels:
co.elastic.logs/enabled: "true" to the tracked container

S
SlavikF, 2022-02-14
@SlavikF

I do like this:

filebeat.autodiscover:
  providers:
  - type: docker
    templates:
      - condition:
          contains:
            docker.container.name: "ng-"

Didn't find what you were looking for?

Ask your question

Ask a Question

731 491 924 answers to any question