Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Filebeat autodiscoverkubernetes appender error bug #9817

Closed
icoolchn opened this issue Dec 28, 2018 · 2 comments · Fixed by #9873
Closed

Filebeat autodiscoverkubernetes appender error bug #9817

icoolchn opened this issue Dec 28, 2018 · 2 comments · Fixed by #9873
Assignees
Labels
bug containers Related to containers use case Filebeat Filebeat libbeat Team:Integrations Label for the Integrations team

Comments

@icoolchn
Copy link

Please post all questions and issues on https://discuss.elastic.co/c/beats
before opening a Github Issue. Your questions will reach a wider audience there,
and if we confirm that there is a bug, then you can open a new issue.

For security vulnerabilities please only send reports to security@elastic.co.
See https://www.elastic.co/community/security for more information.

Please include configurations and logs if available.

For confirmed bugs, please report:

reference Filebeat kubernetes autodiscover Multiple conditions 1

The problem is When the condition has “kubernetes.labels.log-index” ,fields:log_topic: 'labels-{data.kubernetes.labels.log-index}', otherwise fields: log_topic: 'aip-{data.kubernetes.namespace}-${data.kubernetes.pod.name}'
The default condition not.equals.kubernetes.container.name: "filebeat" 。

Currently in use appenders ,But error is ERROR instance/beat.go:691 Exiting: unknown autodiscover appender config
Reference : Filebeat autodiscovery appenders , But there are still ERROR instance/beat.go:691 Exiting: unknown

filebeat run kubernetes daemonset.
filebeat docker image
docker.elastic.co/beats/filebeat:6.5.4
or
docker.elastic.co/beats/filebeat-oss:6.5.3

filebeat.yaml

filebeat.autodiscover:
   providers:
     - type: kubernetes
       hints.enabled: true
       templates:
         - condition.and:
             - not.has_fields: ['kubernetes.labels.log-index']
             - not.equals.kubernetes.container.name: "filebeat"
           config:
             - type: docker
               containers.ids:
                 - "${data.kubernetes.container.id}"
               exclude_lines: ["^\\s+[\\-`('.|_]"]  # drop asciiart lines
               fields:
                 log_topic: 'aip-${data.kubernetes.namespace}-${data.kubernetes.pod.name}'
       appenders:
         - type: config
           condition.and:                      
             - has_fields: ['kubernetes.labels.log-index']
             - not.equals.kubernetes.container.name: "filebeat"        
           config:
             fields:
               log_topic: 'labels-${data.kubernetes.labels.log-index}'
@ruflin ruflin added Filebeat Filebeat libbeat containers Related to containers use case Team:Integrations Label for the Integrations team labels Dec 28, 2018
@exekias exekias added the bug label Jan 3, 2019
@exekias
Copy link
Contributor

exekias commented Jan 3, 2019

I've confirmed this bug, will open a PR to fix it

@qcu266
Copy link

qcu266 commented Mar 2, 2021

I want to use appenders like @icoolchn , so I test @icoolchn 's configuration, but the filebeat reports the following error(filebeat version 7.9.3):

2021-03-02T12:28:24.673Z	INFO	instance/beat.go:456	filebeat stopped.
2021-03-02T12:28:24.673Z	ERROR	instance/beat.go:951	Exiting: error in autodiscover provider settings: error setting up kubernetes autodiscover provider: unable to unpack config due to error: missing field accessing 'filebeat.autodiscover.providers.0.appenders.0.config.fields' (source:'filebeat.yml')
Exiting: error in autodiscover provider settings: error setting up kubernetes autodiscover provider: unable to unpack config due to error: missing field accessing 'filebeat.autodiscover.providers.0.appenders.0.config.fields' (source:'filebeat.yml')

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug containers Related to containers use case Filebeat Filebeat libbeat Team:Integrations Label for the Integrations team
Projects
None yet
Development

Successfully merging a pull request may close this issue.

4 participants