logstash
logstash copied to clipboard
Filebeat not working for k8s ingress nginx controller log
apiVersion: v1
kind: ConfigMap
metadata:
name: filebeat-config
namespace: kube-system
labels:
k8s-app: filebeat
data:
filebeat.yml: |-
filebeat.inputs:
- type: log
enabled: true
paths:
- "/web_log/${NODE_NAME}/services/*.log"
- "/web_log/${NODE_NAME}/sundries/*.log"
# To enable hints based autodiscover, remove `filebeat.inputs` configuration and uncomment this:
filebeat.autodiscover:
providers:
- type: kubernetes
templates:
- condition:
equals:
kubernetes.container.name: "controller"
config:
- module: nginx
access:
enabled: true
input:
type: container
paths:
- /var/lib/docker/containers/${data.kubernetes.container.id}/*.log
but kibana show logs as follows:
"ecs": {
"version": "1.12.0"
},
"stream": "stdout",
"message": "77.76.231.63 - - [03/Aug/2022:06:02:22 +0000] \"POST /backend/HiloPoker?playid=4000-1659497712 HTTP/1.1\" 200 9 \"-\" \"-\" 1759 0.236 [default-web-80] [] 10.244.0.49:80 9 0.234 200 5528dfb277f8173a8da26538f37ea818",
"service": "nginx",
"fileset": {
"name": "access"
},
"agent": {
"id": "84bd8048-991b-45fa-b4f6-86d1ce765e82",
"hostname": "k8snode",
"name": "k8snode",
"ephemeral_id": "09d3d888-bba0-44eb-9cf5-5637e9a1942e",
"version": "7.17.0",
"type": "filebeat"
},
can anyone help me?
Hi @SABERYJS , Can you move the issue under https://github.com/elastic/beats if it is related to beats?