feat(ext/filebeat): ingest ES logs via elasticsearch module

Ensures that Elasticsearch log entries are processed through dedicated ingestion pipelines, so that their fields can be automatically extracted.
deviantony · Feb 14, 2024 · 5da1bad · 5da1bad
1 parent e3a9d60
commit 5da1bad
Show file tree

Hide file tree

Showing 2 changed files with 12 additions and 0 deletions.
diff --git a/extensions/filebeat/config/filebeat.yml b/extensions/filebeat/config/filebeat.yml
@@ -19,6 +19,17 @@ filebeat.autodiscover:
         type: container
         paths:
           - /var/lib/docker/containers/${data.container.id}/*-json.log
+      templates:
+        - condition:
+            contains:
+              docker.container.image: elasticsearch
+          config:
+            - module: elasticsearch
+              server:
+                input:
+                  type: container
+                  paths:
+                    - /var/lib/docker/containers/${data.container.id}/*-json.log
 
 processors:
   - add_cloud_metadata: ~

diff --git a/setup/roles/filebeat_writer.json b/setup/roles/filebeat_writer.json
@@ -2,6 +2,7 @@
   "cluster": [
     "manage_ilm",
     "manage_index_templates",
+    "manage_ingest_pipelines",
     "monitor",
     "read_pipeline"
   ],