From dfdeca78db57159ce71cd025f329d411d800950c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Carlos=20P=C3=A9rez-Aradros=20Herce?= <exekias@gmail.com>
Date: Wed, 3 Jan 2018 17:10:27 +0100
Subject: [PATCH] Cherry-pick #5963 to 6.1: Use docker prospector in examples,
 fixes #5934 and #5920 (#5976)

* Use docker prospector in K8S examples, fixes #5934 and #5920 (#5963)

New docker prospector properly sends log entries in message
field (see #5920). Remove unused POD_NAMESPACE env var from
filebeat manifest.
(cherry picked from commit 241aa3c5de5eae368d408f1d8cb288675a8d10d4)

* Update NOTICE.txt
---
 CHANGELOG.asciidoc                                 |  1 +
 NOTICE.txt                                         |  2 +-
 deploy/kubernetes/filebeat-kubernetes.yaml         | 13 +++----------
 deploy/kubernetes/filebeat/filebeat-configmap.yaml |  9 +++------
 deploy/kubernetes/filebeat/filebeat-daemonset.yaml |  4 ----
 5 files changed, 8 insertions(+), 21 deletions(-)

diff --git a/CHANGELOG.asciidoc b/CHANGELOG.asciidoc
index b9546855115..c3207108473 100644
--- a/CHANGELOG.asciidoc
+++ b/CHANGELOG.asciidoc
@@ -49,6 +49,7 @@ https://github.com/elastic/beats/compare/v6.1.1...6.1[Check the HEAD diff]
 *Auditbeat*
 
 *Filebeat*
+- Switch to docker prospector in sample manifests for Kubernetes deployment {pull}5963[5963]
 
 *Heartbeat*
 
diff --git a/NOTICE.txt b/NOTICE.txt
index bc1c2506aff..7406aa63ca3 100644
--- a/NOTICE.txt
+++ b/NOTICE.txt
@@ -1,5 +1,5 @@
 Elastic Beats
-Copyright 2014-2017 Elasticsearch BV
+Copyright 2014-2018 Elasticsearch BV
 
 This product includes software developed by The Apache Software 
 Foundation (http://www.apache.org/).
diff --git a/deploy/kubernetes/filebeat-kubernetes.yaml b/deploy/kubernetes/filebeat-kubernetes.yaml
index 5ac2903e8eb..f25506af207 100644
--- a/deploy/kubernetes/filebeat-kubernetes.yaml
+++ b/deploy/kubernetes/filebeat-kubernetes.yaml
@@ -41,15 +41,12 @@ metadata:
     kubernetes.io/cluster-service: "true"
 data:
   kubernetes.yml: |-
-    - type: log
-      paths:
-        - /var/lib/docker/containers/*/*.log
-      json.message_key: log
-      json.keys_under_root: true
+    - type: docker
+      containers.ids:
+      - "*"
       processors:
         - add_kubernetes_metadata:
             in_cluster: true
-            namespace: ${POD_NAMESPACE}
 ---
 apiVersion: extensions/v1beta1
 kind: DaemonSet
@@ -88,10 +85,6 @@ spec:
           value:
         - name: ELASTIC_CLOUD_AUTH
           value:
-        - name: POD_NAMESPACE
-          valueFrom:
-            fieldRef:
-              fieldPath: metadata.namespace
         securityContext:
           runAsUser: 0
         resources:
diff --git a/deploy/kubernetes/filebeat/filebeat-configmap.yaml b/deploy/kubernetes/filebeat/filebeat-configmap.yaml
index 84925fef649..ab0321a0424 100644
--- a/deploy/kubernetes/filebeat/filebeat-configmap.yaml
+++ b/deploy/kubernetes/filebeat/filebeat-configmap.yaml
@@ -41,12 +41,9 @@ metadata:
     kubernetes.io/cluster-service: "true"
 data:
   kubernetes.yml: |-
-    - type: log
-      paths:
-        - /var/lib/docker/containers/*/*.log
-      json.message_key: log
-      json.keys_under_root: true
+    - type: docker
+      containers.ids:
+      - "*"
       processors:
         - add_kubernetes_metadata:
             in_cluster: true
-            namespace: ${POD_NAMESPACE}
diff --git a/deploy/kubernetes/filebeat/filebeat-daemonset.yaml b/deploy/kubernetes/filebeat/filebeat-daemonset.yaml
index 759e35958a6..9ffb06d46d3 100644
--- a/deploy/kubernetes/filebeat/filebeat-daemonset.yaml
+++ b/deploy/kubernetes/filebeat/filebeat-daemonset.yaml
@@ -35,10 +35,6 @@ spec:
           value:
         - name: ELASTIC_CLOUD_AUTH
           value:
-        - name: POD_NAMESPACE
-          valueFrom:
-            fieldRef:
-              fieldPath: metadata.namespace
         securityContext:
           runAsUser: 0
         resources: