Filebeat autodiscovery based on pod labels

10/19/2021

Provided configmap works fine (filebeat->logstash->elasticsearch), but I want to modify it in order to use kubernetes.pod.labels instead of kubernetes.container.name.

Could you please suggest me how to do it, I tried different approaches with not success :(

  5 apiVersion: v1
  6 data:
  7   filebeat.yml: |
  8     filebeat.autodiscover:
  9       providers:
 10         - type: kubernetes
 11           templates:
 12             - condition:
 13                 equals:
 14                   kubernetes.container.name: "controller"
 15               config:
 16                 - module: nginx
 17                   ingress_controller:
 18                     enabled: true
 19                     input:
 20                       type: container
 21                       paths:
 22                         - /var/log/containers/*-${data.kubernetes.container.id}.log
 23 
 24     output.logstash:
 25       hosts: ["XX.XX.XX.XX:5044"]

Additionally I provided pod labels below:

  1 apiVersion: v1
  2 kind: Pod
  3 metadata:
  4   annotations:
  5     cni.projectcalico.org/podIP: 10.113.132.3/32
  6   creationTimestamp: "2021-09-28T15:02:39Z"
  7   generateName: ingress-nginx-controller-c7d64c64d
  8   labels:
  9     app.kubernetes.io/component: controller
 10     app.kubernetes.io/instance: ingress-nginx
 11     app.kubernetes.io/name: ingress-nginx
 12     pod-template-hash: c7d64c64d
 13   managedFields:
 14   ....
-- Marat Gainutdinov
elasticsearch
filebeat
kubernetes
nginx-ingress

0 Answers