Traefik frontend_name is missing

[iwex]

Please post all questions and issues on https://discuss.elastic.co/c/beats
before opening a Github Issue. Your questions will reach a wider audience there,
and if we confirm that there is a bug, then you can open a new issue.

For security vulnerabilities please only send reports to security@elastic.co.
See https://www.elastic.co/community/security for more information.

For confirmed bugs, please report:

• Version: filebeat:6.3.2
• Operating System: docker container (ubuntu 18.04)
• Discuss Forum URL: https://discuss.elastic.co/t/traefik-logs/145072/2
• Steps to Reproduce:

Add logging for traefik (v. 1.6.5) with this filebeat.yaml

filebeat.config:
  modules:
    path: ${path.config}/modules.d/*.yml
    reload.enabled: false
 
setup.template.settings:
  index.number_of_shards: 3
 
setup.kibana:
  host: "kibana:5601"
 
  output.elasticsearch:
    hosts: ["elasticsearch:9200"]
 
  setup.template.fields: "${path.config}/fields.yml"
 
  tags: ["traefik"]

And there is no traefil.access.frontend_name in ElasticSearch records.

[ruflin]

Is this the same issue as #6467 or is the field completely missing?

[iwex]

@ruflin In that issue @darkl0rd has this fields, but he wants to visualize it correctly. In my case, I don't have traefik.access.frontend_name field at all.

[iwex]

@ruflin There even no traefik.access.frontend_name in tests https://github.com/elastic/beats/blob/a5397861bc8c2004656a5acf6497d73ccdd44b3a/filebeat/module/traefik/access/test/test.log-expected.json

[ruflin]

@iwex Would it be possible to share some of your log lines here so we could use them for testing?

[iwex]

@ruflin sure!

1.2.3.4 - - [21/Aug/2018:08:11:16 +0000] "GET /v-09051994 HTTP/1.1" 302 356 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1" 1949 "Host-somehost-com-www-somehost-com-1" "http://172.22.0.3:80" 299ms
5.6.7.8 - - [21/Aug/2018:08:11:47 +0000] "GET /02071994 HTTP/1.1" 301 400 "android-app://com.google.android.googlequicksearchbox" "Mozilla/5.0 (Linux; Android 7.0; G3311 Build/43.0.A.7.70) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3440.91 Mobile Safari/537.36" 1950 "Host-somehost-com-www-somehost-com-1" "http://172.22.0.3:80" 63ms
9.10.11.12 - - [21/Aug/2018:08:18:05 +0000] "GET /02071994-3335 HTTP/1.1" 301 400 "-" "Mozilla/5.0 (Linux; Android 8.0.0; LG-H870 Build/OPR1.170623.032) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3440.91 Mobile Safari/537.36" 1951 "Host-somehost-com-www-somehost-com-1" "http://172.22.0.3:80" 72ms

[iwex]

"Host-somehost-com-www-somehost-com-1" should be traefik.access.frontend_name

[ruflin]

I had a quick look at our grok pattern and there is something wrong here to match your log line: "(?:%{NUMBER:traefik.access.body_sent.bytes}|-)( \"%{DATA:traefik.access.referrer}\")?( \"%{DATA:traefik.access.agent}\")?(?:%{NUMBER:traefik.access.request_count}|-)?( \"%{DATA:traefik.access.frontend_name}\")?( \"%{DATA:traefik.access.backend_url}\")?" There is for example also the part missing that would caputure 299ms in the above.

We combine for the fileset dissect with grok patterns. I need to further investigate here.

[iwex]

@ruflin great, thanks. I have default traefik (1.6.5 Latest stable) installation.

[sayden]

We are working in improvements in Traefik module here #8768 that will probably include frontend_name too

[sayden]

Fixed in #8768