Any way to filter what containers get logged?

[Ryuzavi]

Hey

Got this working with separate images for ELK. Notice that the filebeat container obviously picks up all the containers (including itself!).

Is there anyway to filter what containers filebeat picks up?

Cheers,
R.

[gdubya]

I'm testing out an implementation of this using container labels, i.e. only process containers that have a specific key / value in the labels. Have a look at my fork for details: https://github.com/gdubya/docker-filebeat

UPDATE: Sorry, no longer maintaining the fork, however the changes are contained in a gist: https://gist.github.com/gdubya/23b3fc0ff58084d3df85fe8a798ff2f5

[willfarrell]

I took a slightly different approach where it defaults to a label, but has teh option to choose your own label or use all.

Full source at: https://github.com/willfarrell/docker-filebeat/blob/master/5-stdin/docker-entrypoint.sh

# Set container selector
  if [ "$STDIN_CONTAINER_LABEL" == "all" ]; then
    selector() {
      jq -r .[].Id
    }
  else
    selector() {
      jq -r '.[] | select(.Labels["'${STDIN_CONTAINER_LABEL:=filebeat.stdin}'"] == "true") | .Id'
    }
  fi

while true; do
    CONTAINERS=$(curl --no-buffer -s -XGET --unix-socket ${DOCKER_SOCK} http://localhost/containers/json | selector)
    ...
    sleep 5
  done

[yayitswei]

@gdubya Looks like you took down your fork, would you mind republishing it somewhere or sharing your solution? Thanks!

[gdubya]

Ah, sorry, I deleted the fork. But here's a gist containing the changes that I made to Dockerfile and the entrypoint script: https://gist.github.com/gdubya/23b3fc0ff58084d3df85fe8a798ff2f5