Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

filebeat: add docker image name field to journald input #40450

Merged
merged 3 commits into from
Aug 30, 2024
Merged

filebeat: add docker image name field to journald input #40450

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
00b7f18
filebeat: add docker image name field to journald input
msanft Aug 7, 2024
b113b71
Merge branch 'main' into msanft/filebeat/add-image-name-journald
belimawr Aug 9, 2024
307dce4
filebeat: add docker image name field to journald input
msanft Aug 7, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions CHANGELOG.next.asciidoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,6 +41,7 @@ https://github.com/elastic/beats/compare/v8.8.1\...main[Check the HEAD diff]
- Journald: removed configuration options `include_matches.or`, `include_matches.and`, `backoff`, `max_backoff`, `cursor_seek_fallback`. {pull}40061[40061]
- Journald: `include_matches.match` now behaves in the same way as matchers in `journalctl`. Users should carefully update their input configuration. {pull}40061[40061]
- Journald: `seek` and `since` behaviour have been simplified, if there is a cursor (state) `seek` and `since` are ignored and the cursor is used. {pull}40061[40061]
- Added `container.image.name` to `journald` Filebeat input's Docker-specific translated fields. {pull}40450[40450]

*Heartbeat*

Expand Down
3 changes: 2 additions & 1 deletion filebeat/docs/inputs/input-journald.asciidoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -284,7 +284,8 @@ available:
`CONTAINER_ID_FULL`:: `container.id`
`CONTAINER_NAME`:: `container.name`
`CONTAINER_PARTIAL_MESSAGE`:: `container.partial`
`CONTAINER_TAG`:: `container.image.tag`
`CONTAINER_TAG`:: `container.log.tag`
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Just to be sure to understand, what is the reason to switch from container.image.tag to container.log.tag?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It's just a matter of correcting the docs. The actual field is called container.log.tag

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Make sense thanks for the explanation!
Looks good to be merged then!

`IMAGE_NAME`:: `container.image.name`

[id="{beatname_lc}-input-{type}-common-options"]
include::../inputs/input-common-options.asciidoc[]
Expand Down
1 change: 1 addition & 0 deletions filebeat/input/journald/pkg/journalfield/default.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -79,6 +79,7 @@ var journaldEventFields = FieldConversion{
"CONTAINER_NAME": text("container.name"),
"CONTAINER_TAG": text("container.log.tag"),
"CONTAINER_PARTIAL_MESSAGE": text("container.partial"),
"IMAGE_NAME": text("container.image.name"),

// dropped fields
"_SOURCE_MONOTONIC_TIMESTAMP": ignoredField, // received timestamp stored in @timestamp
Expand Down
Loading