You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
I've tried a few approaches to try to use Filebeat and Metricbeat's elasticsearch module in an ECK environment to no avail. Here are the issues as I have found them:
Metricbeat
Metricbeat's elasticsearch module must need to run on a 1:1 basis for each Elasticsearch pod, so perhaps a side-car deployment without any changes to the module would work.
Filebeat
The default kubernetes logs ingestion doesn't seem to work for a number of reasons, which I assume are mostly due to the elasticsearch module being required as the authority on format/enrichment for integrations such as monitoring.
Autodiscover with module support didn't seem to work but I'm unclear on the issues why. It seems that Kubernetes autodiscovery is a higher level problem, and that the current issue is a matter of making the module compatible with Kubernetes.
The elasticsearch module is supposed to auto-configure to it's environment, but mistakenly picks up Redhat as the environment , and looks for /var/log/elasticsearch/*.
In Kubernetes, all logs are in a single file differentiated by the type key. Normal Elasticsearch logs in JSON format also follow this pattern, but are separated into different files. The module doesn't seem to support a single-file input.
There is some related information here but not specific to the monitoring & logging modules.
The text was updated successfully, but these errors were encountered:
…tdout is selected. (elastic#15707)
* Disable default logger when stdlog or the default all selector is not enabled.
* Fix issue where default go logger is not discarded when either * or stdout is selected. Fixelastic#10251.
* Change logic to always discard unless in debug and when all or stdlog is selected. Add more tests.
* Fix comments.
* Add changelog entry.
(cherry picked from commit 1838734)
…tdout is selected. (#15707) (#15880)
* Disable default logger when stdlog or the default all selector is not enabled.
* Fix issue where default go logger is not discarded when either * or stdout is selected. Fix#10251.
* Change logic to always discard unless in debug and when all or stdlog is selected. Add more tests.
* Fix comments.
* Add changelog entry.
(cherry picked from commit 1838734)
Co-authored-by: kaiyan-sheng <[email protected]>
This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.
I've tried a few approaches to try to use Filebeat and Metricbeat's elasticsearch module in an ECK environment to no avail. Here are the issues as I have found them:
Metricbeat
Filebeat
The default kubernetes logs ingestion doesn't seem to work for a number of reasons, which I assume are mostly due to the elasticsearch module being required as the authority on format/enrichment for integrations such as monitoring.
Autodiscover with module support didn't seem to work but I'm unclear on the issues why. It seems that Kubernetes autodiscovery is a higher level problem, and that the current issue is a matter of making the module compatible with Kubernetes.
The elasticsearch module is supposed to auto-configure to it's environment, but mistakenly picks up Redhat as the environment , and looks for /var/log/elasticsearch/*.
In Kubernetes, all logs are in a single file differentiated by the
type
key. Normal Elasticsearch logs in JSON format also follow this pattern, but are separated into different files. The module doesn't seem to support a single-file input.There is some related information here but not specific to the monitoring & logging modules.
The text was updated successfully, but these errors were encountered: