fl-deploy/docker-compose/filebeat/filebeat.compose.yml at dc389b4339e1b48e5d2f7e4fb82cad5019db633e · funlessdev/fl-deploy · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
filebeat:
  autodiscover:
    providers:
      - type: docker
        templates:
          - condition:
              not:
                or:
                  - contains:
                      docker.container.name: "filebeat"
                  - contains:
                      docker.container.name: "elasticsearch"
                  - contains:
                      docker.container.name: "kibana"
            config:
              - type: log
                paths:
                  - "/var/lib/docker/containers/${data.docker.container.id}/*.log"
output:
  elasticsearch:
    hosts: '${ELASTICSEARCH_HOSTS:elasticsearch:9200}'
    username: elastic
    password: '${ELASTIC_PASSWORD:-}'

processors:
  - decode_json_fields:
      fields: ["message"]
  - rename:
      # extract message content for cleaner output; move stream to own field for easier querying
      fields:
        - from: "message"
          to: "message_old"
        - from: "message_old.log"
          to: "message"
        - from: "message_old.stream"
          to: "stream"
  - drop_fields:
      fields: ["message_old"]