Containers (Docker) Inputs

George Alpizar
George Alpizar
  • Updated

Overview

This input type allows you to specify a set of Docker containers for Edge Delta to monitor.

Note

To have the agent process lines for a specific line separation rule, you need to define a "line_pattern" regex rule.

  • When you define a "line_pattern" regex rule, the agent will not process lines for New Line("\n").

Review Parameters

Review the following parameters that you can configure in the Edge Delta App:

Visual Editor YAML Description
Container Labels labels

Enter a descriptive label for this input. 

When you create a workflow, you will use this label to enter your input into the workflow. 

billing,billing-ui,errorcheck is the default label.

This parameter is required. 

Review the following example: 

labels: "apache-web"
Container Include  include

Enter the container attributes to include.

Note

In the visual editor, in the Container Include field, note that if the value you provide after image= is contained anywhere in the image name, then the value will match.

To specify which input to add, you must provide include/exclude regex filters.

  • All rules in the same line with a comma(",") separated means AND:

     include:
   - "rule-1,rule-2"

  • All rules under the same part (include/exclude) means OR:

     include:
   - "rule-1"
   - "rule-2"

This parameter is optional. 

Review the following example: 

include: 
  - "image=gitlab/nginx:latest"
Container Exclude  exclude

Enter the container attributes to exclude.

To specify which input to add, you must provide include/exclude regex filters.

  • All rules in the same line with a comma(",") separated means AND:

     exclude:
   - "rule-1,rule-2"

  • All rules under the same part (include/exclude) means OR:

     exclude:
   - "rule-1"
   - "rule-2"

This parameter is optional. 

Review the following example: 

exclude: 
  - "image=.*nginx.*" 
  - "name=.*nginx.*"
Auto Line Detection 

auto_detect_line_pattern

Enter true (or false) to enable auto line detection for log messages with multiple lines. 

This parameter is optional. 

Review the following example: 

auto_detect_line_pattern: true
Boost Stacktrace Detection 

boost_stracktrace_detection

Enter true (or false) to fallback (troubleshoot) missing content that resulted from the Auto Line Detection parameter. 

This parameter is optional. 

Review the following example:

boost_stacktrace_detection: true
Filters filters

Select an existing filter to add to this input. 

To learn how to create a filter, see Filters.

This parameter is optional. 

Review the following example: 

filters:
  - info
  - not_trace
  - mask_card
  - mask_password
Enrichments

enrichments

You can use this parameter to enrich data with specified extracted fields. 

To learn how to enrich data from inputs, see Enrich Input Data.

This parameter is optional. 

Review the following example: 

enrichments:
  from_path:
    field_mappings:
      - field_name: application
        pattern: /var/logs/anyDir/(?:(.+)/)?users/.*
Not applicable enable_incoming_line_anomalies

Enter true or false to generate anomaly scores.  

This parameter is optional. 

Review the following example: 

enable_incoming_line_anomalies: true

Review Sample Configuration 

Review the following sample configuration:

  containers:
    - labels: "nginx,errorcheck"
      include:
        - "image=gitlab/nginx:latest"
    - labels: "billing,billing-ui,errorcheck"
      include:
        - "image=billing-dashboard:.*"
      enable_incoming_line_anomalies: true
    - labels: "errorcheck"
      include:
        - "image=.*"
      auto_detect_line_pattern: true
    - labels: "apache-web"
      include:
      - "name=apache*,image=.*latest$"
      exclude:
        - "image=.*nginx.*"
        - "name=.*nginx.*"
      line_pattern: '^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}'

 

 

Share this document