Thu thu thập log từ các container cụ thể sử dụng Filebeat

.
├── docker-compose.yml
└── filebeat
   └── config
      └── filebeat.yml

docker-compose.yml

services:
  filebeat:
    image: docker.elastic.co/beats/filebeat-wolfi:9.2.1@sha256:6a724c1bfacc2593e1989fa54b8cb020976dbb361ecaf773fa2916ceb91aac20
    container_name: filebeat
    user: root
    volumes:
      - ./filebeat/config/filebeat.yml:/usr/share/filebeat/filebeat.yml:ro
      - /var/lib/docker/containers:/var/lib/docker/containers:ro
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ./filebeat/registry:/usr/share/filebeat/data:rw
    command: filebeat -e --strict.perms=false

filebeat.yml

cloud.id: "<cloud_id>"
cloud.auth: "<username>:<password>"

filebeat.autodiscover:
  providers:
    - type: docker
      host: unix:///var/run/docker.sock
      hints.enabled: true
      templates:
        - condition:
            contains:
              docker.container.image: nginx
          config:
            - type: filestream
              id: container-${data.docker.container.id}
              prospector.scanner.symlinks: true
              close.on_state_change.removed: false
              parsers:
                - container: ~
              paths:
                - /var/lib/docker/containers/${data.docker.container.id}/*.log

processors:
  - add_docker_metadata: ~