[filebeat] exclude_lines dont work with docker or kubernetes doc examples (input type container)

[ebuildy]

From documentation at https://www.elastic.co/guide/en/beats/filebeat/current/configuration-autodiscover-hints.html#_co_elastic_logsexclude_lines

This say we can use exclude_lines input option with Docker or Kubernetes, but this dont work.

When reading code source, I see excludeLines only for type: filestream not for Docker or Log: https://github.com/elastic/beats/blob/main/filebeat/input/filestream/input.go#L402.

I see container input is using log input under the wood (https://github.com/elastic/beats/blob/main/filebeat/input/container/input.go#L74), that is deprecated, do you plan to use filestream instead?

---

edit:

Related to https://github.com/elastic/beats/issues/34393

I see there is from 1 year a discussion around "replace type: container  by type: filestream", some official documentation is with filestream, and some with container :-/

type: filestream --> https://github.com/elastic/beats/blob/main/deploy/kubernetes/filebeat-kubernetes.yaml type: container --> https://www.elastic.co/guide/en/beats/filebeat/current/configuration-autodiscover.html

So the big question, how configure filebeat with kubernetes ^^ ?

[elasticmachine]

Pinging @elastic/elastic-agent-data-plane (Team:Elastic-Agent-Data-Plane)

[VihasMakwana]

@ebuildy exclude_lines also works for log input https://github.com/elastic/beats/blob/main/filebeat/input/log/harvester.go#L496C21-L513. Can your filebeat config and any logs, if possible?

[botelastic[bot]]

Hi! We just realized that we haven't looked into this issue in a while. We're sorry!

We're labeling this issue as Stale to make it hit our filters and make sure we get back to it as soon as possible. In the meantime, it'd be extremely helpful if you could take a look at it as well and confirm its relevance. A simple comment with a nice emoji will be enough :+1. Thank you for your contribution!