Consuming pod logs on Openshift with Filebeat

Question

I've configured filebeat instance, and when it was running without errors, I've figured out, it does nothing.

I've found in log the following line:

 INFO   log/input.go:138    Configured paths: [/var/lib/docker/containers/*/*.log]

Quick check and I've found out, that the difference between openshift and pure docker is, that in docker the directories under /var/lib/docker/containers contains log files and under openshift they don't.

How should I configure filebeat to work under openshift ?

Answer 1

AFAIK OpenShift also log out container logs as /var/lib/docker/containers/<hash>/*-json.log format, refer Viewing available container logs for more details. If you can not find out at the directory, your docker log driver might be configured as journald , it can check from /etc/sysconfig/docker .

OPTIONS=' --selinux-enabled --log-driver=journald --signature-verification=False'

Then you should change journald to json-file for logging into /var/lib/docker/containers/<hash>/*-json.log .

OPTIONS=' --selinux-enabled --log-driver=json-file --signature-verification=False'

you need to restart the docker.service for taking effect.