Switch to Filebeat 6.x for docker log type

Bug #1814557 reported by Shane Peters
10
This bug affects 2 people
Affects Status Importance Assigned to Milestone
Filebeat Charm
Won't Fix
Wishlist
Unassigned

Bug Description

Filebeat 6.x provides a new log type called 'docker'. Ideal for kube-logs, this significantly helps decoding multi-line JSON messages. More specifically, java exceptions, which at this point generate multiple log messages for a single stack trace.

I've tested this using the cdk-monitoring.yaml bundle, upgrading filebeat to 6.x, and configuring the new docker log type (after disabling jujud-unit-filebeat).

Using an example java exception encoded in json at https://pastebin.ubuntu.com/p/wqjwrNDFBv/ and appending it to an existing docker log, I'm able to see a single log message in graylog for it. Before, this would have been separated into 4 different messsages.

Eric Chen (eric-chen)
Changed in filebeat-charm:
importance: Undecided → Wishlist
status: New → Triaged
Eric Chen (eric-chen)
Changed in filebeat-charm:
status: Triaged → Won't Fix
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.