elkninja / elastic-stack-docker-part-one

Getting up and running with Elastic Stack on Docker-Compose
Apache License 2.0
187 stars 118 forks source link

filebeat autodiscovery for docker broken since 8.12 #31

Open daudo opened 2 weeks ago

daudo commented 2 weeks ago

while as per .env file, this project is still at version 8.7.1, newer versions of filebeat have changed/broken the way how autodiscovery works for containers not running in k8s.

See this thread for a better description https://discuss.elastic.co/t/filebeat-docker-autodiscovery-stopped-working-when-i-upgraded-to-8-12-0/353103

For this reason, the filebeat.yml of this project does not allow filebeat to process Docker logs.

What worked for me is so change the filebeat.autodiscover in filebeat.yml section to this:

filebeat:
  autodiscover:
    providers:
    - hints.default_config:
        paths:
        - /var/lib/docker/containers/${data.container.id}/*.log
        type: container
      hints.enabled: true
      type: docker

If you wish, I can also produce a PR for this (I may also produce another one for podman support).