使用Filebeat在Openshift上使用Pod日志

Question

I've configured filebeat instance, and when it was running without errors, I've figured out, it does nothing.

I've found in log the following line:

 INFO   log/input.go:138    Configured paths: [/var/lib/docker/containers/*/*.log]

Quick check and I've found out, that the difference between openshift and pure docker is, that in docker the directories under /var/lib/docker/containers contains log files and under openshift they don't.

How should I configure filebeat to work under openshift ?

Answer 1

AFAIK OpenShift also log out container logs as /var/lib/docker/containers/<hash>/*-json.log format, refer Viewing available container logs for more details. If you can not find out at the directory, your docker log driver might be configured as journald , it can check from /etc/sysconfig/docker .

OPTIONS=' --selinux-enabled --log-driver=journald --signature-verification=False'

Then you should change journald to json-file for logging into /var/lib/docker/containers/<hash>/*-json.log .

OPTIONS=' --selinux-enabled --log-driver=json-file --signature-verification=False'

you need to restart the docker.service for taking effect.