Version: 6.5.4
Operating system: Amazon Linux 2
Discuss Forum URL: https://discuss.elastic.co/t/incorrect-journalbeat-container-output-fields-for-docker-journald-messages/166017
Journalbeat translates the CONTAINER_TAG field generated by the Docker journald log driver to container.image.tag: https://github.com/elastic/beats/blob/v6.5.4/journalbeat/reader/fields.go#L86
This is not consistent with the semantics for container.image.tag in ECS: https://github.com/elastic/ecs#container
Container image tag.
The CONTAINER_TAG field generated by the Docker journald log driver can be customized using --log-opt tag=..., and it defaults to the short container ID: https://docs.docker.com/config/containers/logging/journald/#options https://docs.docker.com/config/containers/logging/log_tags/
It would be possible to configure Docker with --log-opt 'tag={{.ImageName}}', but this would generate a CONTAINER_TAG field with the full REPOSITORY/IMAGE:TAG field, not just the tag part.
I don't know what the correct translated field would be, ECS does not include any appropriate field for the user-defined CONTAINER_TAG. However, the CONTAINER_TAG field is very useful for applying the correct logstash grok rules to the correct container outputs, because the container.name can vary on different hosts or similar containers.
Version: 6.5.4
Operating system: Amazon Linux 2
Discuss Forum URL: https://discuss.elastic.co/t/incorrect-journalbeat-container-output-fields-for-docker-journald-messages/166017
Journalbeat translates the
CONTAINER_TAGfield generated by the Docker journald log driver tocontainer.image.tag: https://github.com/elastic/beats/blob/v6.5.4/journalbeat/reader/fields.go#L86This is not consistent with the semantics for
container.image.tagin ECS: https://github.com/elastic/ecs#containerThe
CONTAINER_TAGfield generated by the Docker journald log driver can be customized using--log-opt tag=..., and it defaults to the short container ID: https://docs.docker.com/config/containers/logging/journald/#options https://docs.docker.com/config/containers/logging/log_tags/It would be possible to configure Docker with
--log-opt 'tag={{.ImageName}}', but this would generate aCONTAINER_TAGfield with the fullREPOSITORY/IMAGE:TAGfield, not just the tag part.I don't know what the correct translated field would be, ECS does not include any appropriate field for the user-defined
CONTAINER_TAG. However, theCONTAINER_TAGfield is very useful for applying the correct logstash grok rules to the correct container outputs, because thecontainer.namecan vary on different hosts or similar containers.