Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Improve cgroup_regex docs with examples #20425

Merged
merged 1 commit into from
Aug 4, 2020
Merged

Improve cgroup_regex docs with examples #20425

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
24 changes: 15 additions & 9 deletions libbeat/processors/add_process_metadata/docs/add_process_metadata.asciidoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -72,23 +72,29 @@ field will be present in the output.

`host_path`:: (Optional) By default, the `host_path` field is set to the root
directory of the host `/`. This is the path where `/proc` is mounted. For
different runtime configurations of Kubernetes or Docker, the `host_path` can
different runtime configurations of Kubernetes or Docker, the `host_path` can
be set to overwrite the default.

`cgroup_prefixes`:: (Optional) By default, the `cgroup_prefixes` field is set
to `/kubepods` and `/docker`. This is the prefix where the container ID is
inside cgroup. For different runtime configurations of Kubernetes or Docker,
the `cgroup_prefixes` can be set to overwrite the defaults.

`cgroup_regex`:: (Optional) By default, the container id is extracted from
cgroup file based on `cgroup_prefixes`. This can be overwritten by specifying
regular expression with capture group for capturing container id from cgroup
path. For example: `^\/.+\/.+\/.+\/([0-9a-f]{64}).*`

`cgroup_cache_expire_time`:: (Optional) By default, the
`cgroup_regex`:: (Optional) By default, the container id is extracted from
cgroup file based on `cgroup_prefixes`. This can be overwritten by specifying
regular expression with capture group for capturing container id from cgroup
path. Examples:
. `^\/.+\/.+\/.+\/([0-9a-f]{64}).*` will match the container id of a cgroup
like `/kubepods/besteffort/pod665fb997-575b-11ea-bfce-080027421ddf/b5285682fba7449c86452b89a800609440ecc88a7ba5f2d38bedfb85409b30b1`
. `^\/.+\/.+\/.+\/docker-([0-9a-f]{64}).scope` will match the container id of a cgroup
like `/kubepods.slice/kubepods-burstable.slice/kubepods-burstable-pod69349abe_d645_11ea_9c4c_08002709c05c.slice/docker-80d85a3a585f1575028ebe468d83093c301eda20d37d1671ff2a0be50fc0e460.scope`
. `^\/.+\/.+\/.+\/crio-([0-9a-f]{64}).scope` will match the container id of a cgroup
like `/kubepods.slice/kubepods-burstable.slice/kubepods-burstable-pod69349abe_d645_11ea_9c4c_08002709c05c.slice/crio-80d85a3a585f1575028ebe468d83093c301eda20d37d1671ff2a0be50fc0e460.scope`

`cgroup_cache_expire_time`:: (Optional) By default, the
`cgroup_cache_expire_time` is set to 30 seconds. This is the length of time
before cgroup cache elements expire in seconds. It can be set to 0 to disable
the cgroup cache. In some container runtimes technology like runc, the
the cgroup cache. In some container runtimes technology like runc, the
container's process is also process in the host kernel, and will be affected by
PID rollover/reuse. The expire time needs to set smaller than the PIDs wrap
PID rollover/reuse. The expire time needs to set smaller than the PIDs wrap
around time to avoid wrong container id.