From 1d6323fb17427ecfe4d2e8d7967195fdb5c01be0 Mon Sep 17 00:00:00 2001 From: Flavio Percoco Date: Fri, 6 Mar 2020 22:44:06 +0000 Subject: [PATCH] Improve some logging messages for add_kubernetes_metadata processor (#16866) Switch from Debug to Error when unrecoveral events happen and add extra debug messages when indexing and matching pods. --- CHANGELOG.next.asciidoc | 1 + filebeat/processor/add_kubernetes_metadata/matchers.go | 6 +++--- filebeat/processor/add_kubernetes_metadata/matchers_test.go | 4 ++-- libbeat/processors/add_kubernetes_metadata/kubernetes.go | 4 ++++ .../processors/add_kubernetes_metadata/kubernetes_test.go | 2 ++ 5 files changed, 12 insertions(+), 5 deletions(-) diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc index 8155d28ace3..33afd9eb33c 100644 --- a/CHANGELOG.next.asciidoc +++ b/CHANGELOG.next.asciidoc @@ -66,6 +66,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d - Fix k8s pods annotations broken schema. {pull}16554[16554] - Upgrade go-ucfg to latest v0.8.3. {pull}16450{16450} - Fix `NewContainerMetadataEnricher` to use default config for kubernetes module. {pull}16857[16857] +- Improve some logging messages for add_kubernetes_metadata processor {pull}16866{16866} *Auditbeat* diff --git a/filebeat/processor/add_kubernetes_metadata/matchers.go b/filebeat/processor/add_kubernetes_metadata/matchers.go index 805e55fb43b..e422e45d793 100644 --- a/filebeat/processor/add_kubernetes_metadata/matchers.go +++ b/filebeat/processor/add_kubernetes_metadata/matchers.go @@ -86,7 +86,7 @@ func (f *LogPathMatcher) MetadataIndex(event common.MapStr) string { logp.Debug("kubernetes", "Incoming log.file.path value: %s", source) if !strings.Contains(source, f.LogsPath) { - logp.Debug("kubernetes", "Error extracting container id - source value does not contain matcher's logs_path '%s'.", f.LogsPath) + logp.Err("Error extracting container id - source value does not contain matcher's logs_path '%s'.", f.LogsPath) return "" } @@ -105,7 +105,7 @@ func (f *LogPathMatcher) MetadataIndex(event common.MapStr) string { return podUID } - logp.Debug("kubernetes", "Error extracting pod uid - source value contains matcher's logs_path, however it is too short to contain a Pod UID.") + logp.Err("Error extracting pod uid - source value contains matcher's logs_path, however it is too short to contain a Pod UID.") } } else { // In case of the Kubernetes log path "/var/log/containers/", @@ -125,7 +125,7 @@ func (f *LogPathMatcher) MetadataIndex(event common.MapStr) string { return cid } - logp.Debug("kubernetes", "Error extracting container id - source value contains matcher's logs_path, however it is too short to contain a Docker container ID.") + logp.Err("Error extracting container id - source value contains matcher's logs_path, however it is too short to contain a Docker container ID.") } } diff --git a/filebeat/processor/add_kubernetes_metadata/matchers_test.go b/filebeat/processor/add_kubernetes_metadata/matchers_test.go index 82addc9d3b4..e7b5f3dac56 100644 --- a/filebeat/processor/add_kubernetes_metadata/matchers_test.go +++ b/filebeat/processor/add_kubernetes_metadata/matchers_test.go @@ -85,8 +85,8 @@ func TestLogsPathMatcher_AnotherLogDir(t *testing.T) { cfgLogsPath := "/var/log/other/" sourcePath := "/var/log/other/%s.log" if runtime.GOOS == "windows" { - cfgLogsPath = "C:\\var\\log\\other\\" - sourcePath = "C:\\var\\log\\other\\%s.log" + cfgLogsPath = "C:\\var\\log\\othere\\" + sourcePath = "C:\\var\\log\\othere\\%s.log" } source := fmt.Sprintf(sourcePath, cid) diff --git a/libbeat/processors/add_kubernetes_metadata/kubernetes.go b/libbeat/processors/add_kubernetes_metadata/kubernetes.go index b3bec529420..97bb88da02d 100644 --- a/libbeat/processors/add_kubernetes_metadata/kubernetes.go +++ b/libbeat/processors/add_kubernetes_metadata/kubernetes.go @@ -206,11 +206,14 @@ func (k *kubernetesAnnotator) Run(event *beat.Event) (*beat.Event, error) { } index := k.matchers.MetadataIndex(event.Fields) if index == "" { + k.log.Debug("No container match string, not adding kubernetes data") return event, nil } + k.log.Debugf("Using the following index key %s", index) metadata := k.cache.get(index) if metadata == nil { + k.log.Debugf("Index key %s did not match any of the cached resources", index) return event, nil } @@ -224,6 +227,7 @@ func (k *kubernetesAnnotator) Run(event *beat.Event) (*beat.Event, error) { func (k *kubernetesAnnotator) addPod(pod *kubernetes.Pod) { metadata := k.indexers.GetMetadata(pod) for _, m := range metadata { + k.log.Debugf("Created index %s for pod %s/%s", m.Index, pod.GetNamespace(), pod.GetName()) k.cache.set(m.Index, m.Data) } } diff --git a/libbeat/processors/add_kubernetes_metadata/kubernetes_test.go b/libbeat/processors/add_kubernetes_metadata/kubernetes_test.go index 7d18d169e40..dec8f446fdc 100644 --- a/libbeat/processors/add_kubernetes_metadata/kubernetes_test.go +++ b/libbeat/processors/add_kubernetes_metadata/kubernetes_test.go @@ -25,6 +25,7 @@ import ( "github.com/elastic/beats/v7/libbeat/beat" "github.com/elastic/beats/v7/libbeat/common" + "github.com/elastic/beats/v7/libbeat/logp" ) // Test metadata updates don't replace existing pod metrics @@ -38,6 +39,7 @@ func TestAnnotatorDeepUpdate(t *testing.T) { } processor := kubernetesAnnotator{ + log: logp.NewLogger(selector), cache: newCache(10 * time.Second), matchers: &Matchers{ matchers: []Matcher{matcher},