E
E
EmachinesDIMA2022-01-18 12:44:28
elasticsearch
EmachinesDIMA, 2022-01-18 12:44:28

How to use filebeat to take logs / data FROM the container, and not the logs of the container itself?

the collection of application logs is transferred to files using the "monolog logger php" utility.
And I need to extract the contents of the files from the container.

How to take logs/data FROM the container, and not the logs of the container itself?

filebeat.autodiscover:
  providers:
    # > search docker container
    - type: docker
      # hints.enabled: true
      templates:
        - condition:
            contains:
              docker.container.name: docker_app_1
          config:
            - type: container
              paths:
                - /var/log/*.log

output.logstash:
  enabled: true
  hosts: ["logstash:5044"]
  timeout: 30s
indices:
   - index: "filebeat-%{[@metadata][beat]}-%{+YYYY.MM.dd}"


this config is supposed to work, but ..

+ it will determine the logs FROM the container in my filebeat-* index defined by me?

Answer the question

In order to leave comments, you need to log in

1 answer(s)
E
EmachinesDIMA, 2022-01-19
@EmachinesDIMA

Thanks to Tibor128 for the help!
I got confused and was looking for a way to get logs FROM the container, not taking into account that filebeat cannot connect to the container.
When configuring logging In a container, you need to mount volumes as data storage outside the container and tell filebeat to take logs from this volume (it's just a directory).
examples here
https://www.elastic.co/guide/en/beats/filebeat/cur...
The best option is when the stream is directed to stdout - in this case "container log" = "application log".
examples here
https://www.elastic.co/guide/en/beats/filebeat/cur...

Didn't find what you were looking for?

Ask your question

Ask a Question

731 491 924 answers to any question