logstash icon indicating copy to clipboard operation
logstash copied to clipboard

Filebeat not working for k8s ingress nginx controller log

Open SABERYJS opened this issue 3 years ago • 1 comments

apiVersion: v1
kind: ConfigMap
metadata:
  name: filebeat-config
  namespace: kube-system
  labels:
    k8s-app: filebeat
data:
  filebeat.yml: |-
    filebeat.inputs:
       - type: log
         enabled: true
         paths:
           - "/web_log/${NODE_NAME}/services/*.log"
           - "/web_log/${NODE_NAME}/sundries/*.log"

    # To enable hints based autodiscover, remove `filebeat.inputs` configuration and uncomment this:
    filebeat.autodiscover:
          providers:
            - type: kubernetes
              templates:
                - condition:
                    equals:
                      kubernetes.container.name: "controller"
                  config:
                     - module: nginx
                       access:
                        enabled: true
                        input:
                          type: container
                          paths:
                            - /var/lib/docker/containers/${data.kubernetes.container.id}/*.log

but kibana show logs as follows:

"ecs": {
      "version": "1.12.0"
    },
    "stream": "stdout",
    "message": "77.76.231.63 - - [03/Aug/2022:06:02:22 +0000] \"POST /backend/HiloPoker?playid=4000-1659497712 HTTP/1.1\" 200 9 \"-\" \"-\" 1759 0.236 [default-web-80] [] 10.244.0.49:80 9 0.234 200 5528dfb277f8173a8da26538f37ea818",
    "service": "nginx",
    "fileset": {
      "name": "access"
    },
    "agent": {
      "id": "84bd8048-991b-45fa-b4f6-86d1ce765e82",
      "hostname": "k8snode",
      "name": "k8snode",
      "ephemeral_id": "09d3d888-bba0-44eb-9cf5-5637e9a1942e",
      "version": "7.17.0",
      "type": "filebeat"
    },

can anyone help me?

SABERYJS avatar Aug 03 '22 06:08 SABERYJS

Hi @SABERYJS , Can you move the issue under https://github.com/elastic/beats if it is related to beats?

mashhurs avatar Aug 03 '22 14:08 mashhurs