solution for filebeat paths

Question

i have problem.

this is my filebeat and i have 6 containers in /var/lib/docker/containers:

 filebeat.inputs:
  - type: container
    enabled: true
    paths:
      - '/var/lib/docker/containers/*/*.log'
    json.message_key: log
    json.keys_under_root: true


output.elasticsearch:
  hosts: ["elasticsearch:9200"]

and this is a part of my docker-compose.yml:

  filebeat:
    user: "root"
    image: "docker.elastic.co/beats/filebeat:7.10.2"
    command:
      - "-e"
      - "--strict.perms=false"
    volumes:
      - ./filebeat.yml:/usr/share/filebeat/filebeat.yml:ro
      - /var/lib/docker:/var/lib/docker:ro
      - /var/run/docker.sock:/var/run/docker.sock

now i want to get one of logs from this containers, and my containerId will be changes, how can i solve this problem? (i cant set "*" with containerId)

Answer 1

i find a solution and i changed my filebeat.yml file, this is my new filebeat.yml file:

filebeat:
  autodiscover.providers:
    - type: docker
      templates:
        - condition.contains:
            docker.container.image: logger
          config:
            - module: nginx
              access:
                input:
                  type: container
                  paths:
                    - "/var/lib/docker/containers/${data.docker.container.id}/*.log"
                  json.message_key: log
                  json.keys_under_root: true


output.elasticsearch:
  hosts: ["elasticsearch:9200"]

logger is my container name