Adding inforamtion for CRI-O configuration and enhancing our manifest… (

#32151) * [DOCS] Removed reference to the Stack GS (#32083) * [DOCS] Removed reference to the Stack GS (#32119) * Adding inforamtion for CRI-O configuration and enhancing our manifest comments * Adding CHANGELOG.asciidoc info * Adding CHANGELOG.next.asciidoc info * Keeping only containers path * Keeping only containers path * Keeping only containers path * Adding note * Adding note * Adding note * Adding note * Adding note * Update input-container.asciidoc * Update running-on-kubernetes.asciidoc * Fixing Conflicts * Fixing Conflicts * Removig other path references and kept only /var/log/containers/ * Removig other path references and kept only /var/log/containers/ * Adding generated files Co-authored-by: debadair <debadair@elastic.co>
elastic · Jul 11, 2022 · c47ef26 · c47ef26
1 parent 86bb5f3
commit c47ef26
Show file tree

Hide file tree

Showing 6 changed files with 41 additions and 4 deletions.
diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc
@@ -98,6 +98,7 @@ https://github.com/elastic/beats/compare/v8.2.0\...main[Check the HEAD diff]
 - Add template helper function for decoding hexadecimal strings. {pull}31886[31886]
 - Add new `parser` called `include_message` to filter based on message contents. {issue}31794[31794] {pull}32094[32094]
 - Extend list of mapped record types in o365 Audit module. {pull}32217[32217]
+- Add references for CRI-O configuration in input-container and in our kubernetes manifests {issue}32149[32149] {pull}32151[32151]
 
 *Auditbeat*
 

diff --git a/filebeat/_meta/config/filebeat.autodiscover.reference.yml.tmpl b/filebeat/_meta/config/filebeat.autodiscover.reference.yml.tmpl
@@ -13,4 +13,4 @@
 #          config:
 #            - type: container
 #              paths:
-#                - /var/lib/docker/containers/${data.docker.container.id}/*.log
+#                - /var/log/containers/*.log
diff --git a/filebeat/docs/inputs/input-container.asciidoc b/filebeat/docs/inputs/input-container.asciidoc
@@ -21,11 +21,17 @@ Example configuration:
 {beatname_lc}.inputs:
 - type: container
   paths: <1>
-    - '/var/lib/docker/containers/*/*.log'
+    - '/var/log/containers/*.log'
 ----
 
 <1> `paths` is required. All other settings are optional.
 
+
+> ----
+'/var/log/containers/*.log' is normally a symlink to '/var/log/pods/*/*/.log', 
+so above path can be edited accordingly
+
+
 ==== Configuration options
 
 The `container` input supports the following configuration options plus the

diff --git a/filebeat/docs/running-on-kubernetes.asciidoc b/filebeat/docs/running-on-kubernetes.asciidoc
@@ -112,6 +112,36 @@ oc patch namespace kube-system -p \
 This command sets the node selector for the project to an empty string. If you
 don't run this command, the default node selector will skip master nodes.
 
+In order to support runtime environments with Openshift (eg. CRI-O, containerd) you need to configure following path:
+
+["source","yaml",subs="attributes"]
+----
+{beatname_lc}.inputs:
+- type: container
+  paths: <1>
+    - '/var/log/containers/*.log'
+----
+
+Same path needs to be configured in case autodiscovery needs to be enabled:
+
+["source","yaml",subs="attributes"]
+----
+filebeat.autodiscover:
+  providers:
+    - type: kubernetes
+      node: ${NODE_NAME}
+      hints.enabled: true
+      hints.default_config:
+        type: container
+        paths:
+          - /var/log/containers/*.log
+----
+
+> ----
+'/var/log/containers/*.log' is normally a symlink to '/var/log/pods/*/*/.log', 
+so above paths can be edited accordingly
+
+
 [float]
 ==== Load {kib} dashboards
 

diff --git a/filebeat/filebeat.reference.yml b/filebeat/filebeat.reference.yml
@@ -1201,7 +1201,7 @@ filebeat.inputs:
 #          config:
 #            - type: container
 #              paths:
-#                - /var/lib/docker/containers/${data.docker.container.id}/*.log
+#                - /var/log/containers/*.log
 
 # ========================== Filebeat global options ===========================
 

diff --git a/x-pack/filebeat/filebeat.reference.yml b/x-pack/filebeat/filebeat.reference.yml
@@ -3530,7 +3530,7 @@ filebeat.inputs:
 #          config:
 #            - type: container
 #              paths:
-#                - /var/lib/docker/containers/${data.docker.container.id}/*.log
+#                - /var/log/containers/*.log
 
 # ========================== Filebeat global options ===========================