From ad2ae95a38efb936b599b2ad4a67bb45f23e0d5f Mon Sep 17 00:00:00 2001
From: Alex Macocian <amacocian@yahoo.com>
Date: Thu, 3 Jul 2025 12:57:48 +0200
Subject: [PATCH] Change filebeat docker

---
 filebeat/filebeat.yml         | 15 ++++++++++++++-
 filebeat/modules.d/docker.yml | 11 -----------
 2 files changed, 14 insertions(+), 12 deletions(-)
 delete mode 100644 filebeat/modules.d/docker.yml

diff --git a/filebeat/filebeat.yml b/filebeat/filebeat.yml
index 6443f12..21c9bf9 100644
--- a/filebeat/filebeat.yml
+++ b/filebeat/filebeat.yml
@@ -1,6 +1,13 @@
 # ============================== Filebeat inputs ===============================
 
 filebeat.inputs:
+- type: container                 # ← purpose-built input
+  id: docker-containers
+  paths:
+    - /var/lib/docker/containers/*/*.log   # default JSON logs
+  stream: all
+  clean_removed: true
+
 - type: filestream
   id: my-filestream-id
   enabled: false
@@ -32,4 +39,10 @@ processors:
       when.not.contains.tags: forwarded
   - add_cloud_metadata: ~
   - add_docker_metadata: ~
-  - add_kubernetes_metadata: ~
\ No newline at end of file
+  - add_kubernetes_metadata: ~
+  - add_fields:
+      target: data_stream
+      fields:
+        type: logs
+        dataset: docker.containers
+        namespace: prod
\ No newline at end of file
diff --git a/filebeat/modules.d/docker.yml b/filebeat/modules.d/docker.yml
deleted file mode 100644
index 99a3b88..0000000
--- a/filebeat/modules.d/docker.yml
+++ /dev/null
@@ -1,11 +0,0 @@
-# Module: docker
-- module: docker
-  container_logs:
-    enabled: true
-    
-    # Set custom paths if your docker log location is different
-    #var.paths:
-    #  - /var/lib/docker/containers/*/*.log
-    var.stream: all
-    var.clean_removed: true
-    var.add_docker_metadata: true