Skip to content
This repository has been archived by the owner on May 16, 2023. It is now read-only.

Filebeat improvements #568

Merged
merged 5 commits into from
Apr 10, 2020
Merged

Filebeat improvements #568

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
02e88a6
[filebeat] remove in_cluster config from add_kubernetes_metadata
jmlrt Apr 8, 2020
1322d60
[filebeat] use container input instead of docker input
jmlrt Apr 8, 2020
dc9e716
[filebeat] use recommended values for add_kubernetes_metadata
jmlrt Apr 8, 2020
72f704e
fixup! [filebeat] use container input instead of docker input
jmlrt Apr 9, 2020
d5c048b
[metricbeat] move back to docker input and in_cluster for 6.x
jmlrt Apr 9, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 13 additions & 0 deletions filebeat/examples/6.x/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,3 +3,16 @@ imageTag: 6.8.8
extraEnvs:
- name: ELASTICSEARCH_HOSTS
value: six-master:9200

filebeatConfig:
filebeat.yml: |
filebeat.inputs:
- type: docker
containers.ids:
- '*'
processors:
- add_kubernetes_metadata:
in_cluster: true
output.elasticsearch:
host: '${NODE_NAME}'
hosts: '${ELASTICSEARCH_HOSTS:elasticsearch-master:9200}'
13 changes: 8 additions & 5 deletions filebeat/examples/security/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,12 +1,15 @@
filebeatConfig:
filebeat.yml: |
filebeat.inputs:
- type: docker
containers.ids:
- '*'
- type: container
paths:
- /var/log/containers/*.log
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Just to be sure, is this path actually where hosts' var/log is mounted? This is what I expect to see https://github.com/elastic/beats/blob/1a029e547fb1018668e7ab961bcbbe496696ff25/deploy/kubernetes/filebeat-kubernetes.yaml#L110.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for the notice, fixed by 72f704e

processors:
- add_kubernetes_metadata:
in_cluster: true
- add_kubernetes_metadata:
host: ${NODE_NAME}
matchers:
- logs_path:
logs_path: "/var/log/containers/"

output.elasticsearch:
username: '${ELASTICSEARCH_USERNAME}'
Expand Down
6 changes: 6 additions & 0 deletions filebeat/templates/daemonset.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -75,6 +75,9 @@ spec:
- name: varlibdockercontainers
hostPath:
path: /var/lib/docker/containers
- name: varlog
hostPath:
path: /var/log
- name: varrundockersock
hostPath:
path: /var/run/docker.sock
Expand Down Expand Up @@ -152,6 +155,9 @@ spec:
- name: varlibdockercontainers
mountPath: /var/lib/docker/containers
readOnly: true
- name: varlog
mountPath: /var/log
readOnly: true
# Necessary when using autodiscovery; avoid mounting it otherwise
# See: https://www.elastic.co/guide/en/beats/filebeat/master/configuration-autodiscover.html
- name: varrundockersock
Expand Down
12 changes: 8 additions & 4 deletions filebeat/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,11 +4,15 @@
filebeatConfig:
filebeat.yml: |
filebeat.inputs:
- type: docker
containers.ids:
- '*'
- type: container
paths:
- /var/log/containers/*.log
processors:
- add_kubernetes_metadata: ~
- add_kubernetes_metadata:
host: ${NODE_NAME}
matchers:
- logs_path:
logs_path: "/var/log/containers/"

output.elasticsearch:
host: '${NODE_NAME}'
Expand Down