logspout-logstash
logspout-logstash copied to clipboard
Docker labels causes 400 error in logstash
Using RAW_FORMAT to include docker labels gives an error in logstash and document is written. Really want docker labels. Any idea how to fix this?
version: '3.3'
services:
logspout:
build: ./
volumes:
# Logspout reads this in and attaches it to the log
- /etc/hostname:/etc/host_hostname:ro
- '/var/run/docker.sock:/tmp/docker.sock'
environment:
# IP and port for logstash host
ROUTE_URIS: "logstash://some.dns:6000"
# Include all docker labels
DOCKER_LABELS: "true"
# Add environment field to all logs sent to logstash
LOGSTASH_FIELDS: "environment=${NODE_ENV}"
RETRY_STARTUP: "true"
RAW_FORMAT: '{ "container" : "{{ .Container.Name }}", "labels": {{ toJSON .Container.Config.Labels }}, "source" : "{{ .Source }}", "message" : {{ toJSON .Data }} }'
command: 'raw+udp://some.dns:6000'
deploy:
mode: global
resources:
limits:
cpus: '0.20'
memory: 256M
reservations:
cpus: '0.10'
memory: 128M
restart: on-failure
[2021-06-28T21:18:49,754][WARN ][logstash.outputs.elasticsearch][main][ec5863da584df97e7e09b88e20aac31b53950dfc42b9a358d52a766e775ca61f] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"logstash", :routing=>nil}, {"@version"=>"1", "type"=>"dockerlog", "container"=>"/logspout_logspout_1", "labels"=>{"com.docker.compose.container-number"=>"1", "com.docker.compose.project.config_files"=>"docker-compose.yaml", "com.docker.compose.version"=>"1.27.4", "com.docker.compose.oneoff"=>"False", "com.docker.compose.service"=>"logspout", "com.docker.compose.project.working_dir"=>"/home/pchost/docker/logspout", "com.docker.compose.config-hash"=>"f4c841a27a87d76eee562fc3329790dd68a1001be5e7c2376ca86313c3d2d21f", "com.docker.compose.project"=>"logspout"}, "@timestamp"=>2021-06-28T21:18:49.591Z, "host"=>"192.168.1.232", "source"=>"stdout", "message"=>"# ADAPTER\tADDRESS\t\t\tCONTAINERS\tSOURCES\tOPTIONS"}], :response=>{"index"=>{"_index"=>"logstash", "_type"=>"_doc", "_id"=>"s-99VHoB4-ZIuBnPNYth", "status"=>400, "error"=>{"type"=>"illegal_argument_exception", "reason"=>"mapper [labels.com.docker.compose.project] cannot be changed from type [text] to [ObjectMapper]"}}}}