elkninja / elastic-stack-docker-part-one

Getting up and running with Elastic Stack on Docker-Compose
Apache License 2.0
188 stars 119 forks source link

filebeat autodiscovery for docker broken since 8.12 #31

Open daudo opened 1 month ago

daudo commented 1 month ago

while as per .env file, this project is still at version 8.7.1, newer versions of filebeat have changed/broken the way how autodiscovery works for containers not running in k8s.

See this thread for a better description https://discuss.elastic.co/t/filebeat-docker-autodiscovery-stopped-working-when-i-upgraded-to-8-12-0/353103

For this reason, the filebeat.yml of this project does not allow filebeat to process Docker logs.

What worked for me is so change the filebeat.autodiscover in filebeat.yml section to this:

filebeat:
  autodiscover:
    providers:
    - hints.default_config:
        paths:
        - /var/lib/docker/containers/${data.container.id}/*.log
        type: container
      hints.enabled: true
      type: docker

If you wish, I can also produce a PR for this (I may also produce another one for podman support).