From 44822f6045986b589da80476214ce55e86b05677 Mon Sep 17 00:00:00 2001 From: Antoine Cotten Date: Mon, 12 Feb 2024 10:00:07 +0100 Subject: [PATCH] fix(filebeat): set explicit Docker-centric defaults The default_config changed in elastic/beats@41ab08cd (v8.12.0) from Docker to Kubernetes defaults. This change also changes the default output from 'container' to 'input'. Before we are able to update to v8.12, we need to set defaults which are suitable for the configuration that docker-elk ships with. Refs: https://github.com/elastic/beats/blob/v8.12.0/filebeat/autodiscover/builder/hints/config.go#L30-L51 https://www.elastic.co/guide/en/beats/filebeat/8.12/filebeat-input-container.html https://www.elastic.co/guide/en/beats/filebeat/8.12/filebeat-input-filestream.html --- extensions/filebeat/config/filebeat.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/extensions/filebeat/config/filebeat.yml b/extensions/filebeat/config/filebeat.yml index da8e2ea39f..1e9d0d9d17 100644 --- a/extensions/filebeat/config/filebeat.yml +++ b/extensions/filebeat/config/filebeat.yml @@ -15,6 +15,10 @@ filebeat.autodiscover: # containers as they start and stop. - type: docker hints.enabled: true + hints.default_config: + type: container + paths: + - /var/lib/docker/containers/${data.container.id}/*-json.log processors: - add_cloud_metadata: ~