Brandyn / Techy
6f7fb29ae0
Both Beats already wrote to the same Elasticsearch, but a metric event carried container.name while a log event carried service.name and vanguard.category, so nothing joined them and a dashboard could only show the two side by side. Metricbeat now runs add_docker_metadata and the same copy_fields, giving both sides @timestamp, host.name, container.name, service.name and vanguard.category. LOGGING.md documents the join keys and the one Kibana step that makes it work: a single data view over filebeat-*,metricbeat-* so one filter applies to metric panels and log panels together. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
52 lines
1.9 KiB
YAML
52 lines
1.9 KiB
YAML
# Metricbeat: host and per-container metrics, replacing node_exporter and cAdvisor, plus the Prometheus
|
|
# endpoints the stack already exposes. Runs on the host network so the system module sees the real interfaces
|
|
# and so it can reach MediaMTX, Caddy, Elasticsearch and Kibana on loopback.
|
|
|
|
metricbeat.modules:
|
|
- module: system
|
|
period: 30s
|
|
metricsets: [cpu, load, memory, network, process, process_summary, socket_summary, filesystem, fsstat, diskio, uptime]
|
|
processes: ['.*']
|
|
process.include_top_n:
|
|
by_cpu: 10
|
|
by_memory: 10
|
|
system.hostfs: /hostfs # the host's real filesystems, not the container's
|
|
|
|
- module: docker
|
|
period: 30s
|
|
hosts: ["unix:///var/run/docker.sock"]
|
|
metricsets: [container, cpu, diskio, healthcheck, info, memory, network]
|
|
|
|
- module: prometheus # MediaMTX: per path bytes/s, readers, publishers, dropped packets
|
|
period: 30s
|
|
metrics_path: /metrics
|
|
hosts: ["http://127.0.0.1:9998"]
|
|
|
|
- module: prometheus # Caddy: requests by host and status, durations, TLS
|
|
period: 60s
|
|
metrics_path: /metrics
|
|
hosts: ["http://127.0.0.1:2019"]
|
|
|
|
processors:
|
|
- add_host_metadata: ~
|
|
# The same correlation fields Filebeat sets, so ONE dashboard filter spans logs and metrics. Without these a
|
|
# metric event carries container.name while a log event carries service.name, and nothing joins them.
|
|
- add_docker_metadata: ~
|
|
- copy_fields:
|
|
fields:
|
|
- from: container.labels.vanguard_service
|
|
to: service.name
|
|
- from: container.labels.vanguard_category
|
|
to: vanguard.category
|
|
fail_on_error: false
|
|
ignore_missing: true
|
|
|
|
output.elasticsearch:
|
|
hosts: ["http://127.0.0.1:9200"]
|
|
|
|
setup.kibana:
|
|
host: "http://127.0.0.1:5601"
|
|
setup.dashboards.enabled: true # the system and docker dashboards, so there is something to look at
|
|
|
|
logging.level: info
|