Add docker input support for Filebeat

README.md

@@ -307,10 +307,15 @@ to fully understand what these parameters do.
 
 **Parameters for `filebeat::prospector`**
  - `ensure`: The ensure parameter on the prospector configuration file. (default: present)
- - `paths`: [Array] The paths, or blobs that should be handled by the prospector. (required)
+ - `paths`: [Array] The paths, or blobs that should be handled by the prospector. (required only if input_type is not _docker_)
+ - `containers_ids`: [Array] If input_type is _docker_, the list of Docker container ids to read the logs from. (default: '*')
+ - `containers_path`: [String] If input_type is _docker_, the path from where the logs should be read from. (default: /var/log/docker/containers)
+ - `containers_stream`: [String] If input_type is _docker_, read from the specified stream only. (default: all)
+ - `combine_partial`: [Boolean] If input_type is _docker_, enable partial messages joining. (default: false)
+ - `cri_parse_flags`: [Boolean] If input_type is _docker_, enable CRI flags parsing from the log file. (default: false)
  - `exclude_files`: [Array] Files that match any regex in the list are excluded from filebeat (default: [])
  - `encoding`: [String] The file encoding. (default: plain)
- - `input_type`: [String] log or stdin - where filebeat reads the log from (default:log)
+ - `input_type`: [String] log, docker or stdin - where filebeat reads the log from (default:log)
  - `fields`: [Hash] Optional fields to add information to the output (default: {})
  - `fields_under_root`: [Boolean] Should the `fields` parameter fields be stored at the top level of indexed documents.
  - `ignore_older`: [String] Files older than this field will be ignored by filebeat (default: ignore nothing)

manifests/prospector.pp

@@ -10,6 +10,11 @@
  Enum['absent', 'present'] $ensure = present,
  Array[String] $paths = [],
  Array[String] $exclude_files = [],
+ Array[String] $containers_ids = ['\'*\''],
+ String $containers_path = '/var/lib/docker/containers',
+ String $containers_stream = 'all',
+ Boolean $combine_partial = false,
+ Boolean $cri_parse_flags = false,
  String $encoding = 'plain',
  String $input_type = 'log',
  Hash $fields = {},

spec/defines/prospector_spec.rb

@@ -13,21 +13,21 @@
  }'
  end
 
- let(:title) { 'test-logs' }
- let(:params) do
- {
- 'paths' => [
- '/var/log/auth.log',
- '/var/log/syslog',
- ],
- 'doc_type' => 'syslog-beat',
- }
- end
-
  on_supported_os(facterversion: '2.4').each do |os, os_facts|
  context "on #{os}" do
  let(:facts) { os_facts }
 
+ let(:title) { 'test-logs' }
+ let(:params) do
+ {
+ 'paths' => [
+ '/var/log/auth.log',
+ '/var/log/syslog',
+ ],
+ 'doc_type' => 'syslog-beat',
+ }
+ end
+
  if os_facts[:kernel] != 'windows'
  it { is_expected.to compile }
  end
@@ -38,9 +38,45 @@
  )
  }
  end
+
+ context "with docker input support on #{os}" do
+ let(:facts) { os_facts }
+
+ # Docker Support
+ let(:title) { 'docker' }
+ let(:params) do
+ {
+ 'input_type' => 'docker',
+ }
+ end
+
+ if os_facts[:kernel] != 'windows'
+ it { is_expected.to compile }
+ end
+
+ it {
+ is_expected.to contain_file('filebeat-docker').with(
+ notify: 'Service[filebeat]',
+ )
+ is_expected.to contain_file('filebeat-docker').with_content(
+ %r{- type: docker\n\s{2}containers:\n\s{4}ids:\n\s{4}- '\*'\n\s{4}path: /var/lib/docker/containers\n\s{4}stream: all\n\s{2}combine_partial: false\n\s{2}cri.parse_flags: false\n},
+ )
+ }
+ end
  end
 
  context 'with no parameters' do
+ let(:title) { 'test-logs' }
+ let(:params) do
+ {
+ 'paths' => [
+ '/var/log/auth.log',
+ '/var/log/syslog',
+ ],
+ 'doc_type' => 'syslog-beat',
+ }
+ end
+
  it { is_expected.to raise_error(Puppet::Error) }
  end
 end

templates/prospector.yml.erb

@@ -1,9 +1,21 @@
 ---
 - type: <%= @input_type %>
+ <%- if @input_type != 'docker' -%>
  paths:
- <%- @paths.each do |log_path| -%>
- - <%= log_path %>
+ <%- @paths.each do |log_path| -%>
+ - <%= log_path %>
+ <%- end -%>
+ <%- else -%>
+ containers:
+ ids:
+ <%- @containers_ids.each do |id| -%>
+ - <%= id %>
  <%- end -%>
+ path: <%= @containers_path %>
+ stream: <%= @containers_stream %>
+ combine_partial: <%= @combine_partial %>
+ cri.parse_flags: <%= @cri_parse_flags %>
+ <%- end %>
  <%- if @encoding -%>
  encoding: <%= @encoding %>
  <%- end -%>