Can we make beats gather docker container labels under the compose file deploy section?

[jerrac]

Describe the enhancement: I would like all Beats (or at least Filebeat and Metricbeat) to capture the labels that are under the docker compose/stack deploy section.

Beats currently grabs the labels on a container that are at the root of the service. Things like container.labels.com_docker_stack_namespace on a log doc I just looked at. And if I add custom labels, there, they get picked up as well.

But any labels under the deploy section of a service do not get captured.

At least in the limited testing I've done today.

So, in a docker-compose file like:

version: '3.9'
services:
  hello:
    image: blah
    labels:
      world: "amazing"
    deploy:
        labels:
          star_system: "huge"

Beats will pick up the world: "amazing" label. It will not pick up the star_system: "huge" label.

I'm running a Docker Swarm/Portainer/Traefik stack and the labels under the deploy section of a compose/stack file contain a lot of useful information. Routing info, what network Traefik uses, what port it sends requests to, etc. And I naturally started putting the custom labels I plan on using for alerting there as well.

Describe a specific use case for the enhancement or feature: Using custom labels I plan to route apache logs through the apache logs pipeline.

I could see building a report based on what port Traefik sends requests to.

Filtering based on what kind of Traefik routing rule is in use could be useful.

Note that Traefik labels have to go under the deploy section if you are in swarm mode.

Thanks in advance for any consideration you give this!

[elasticmachine]

Pinging @elastic/integrations (Team:Integrations)

[jerrac]

For the record, the work around is to place labels in both locations. As a firm believer in DRY, I am not fond of that. :\

[botelastic[bot]]

Hi! We just realized that we haven't looked into this issue in a while. We're sorry!

We're labeling this issue as Stale to make it hit our filters and make sure we get back to it as soon as possible. In the meantime, it'd be extremely helpful if you could take a look at it as well and confirm its relevance. A simple comment with a nice emoji will be enough :+1. Thank you for your contribution!