Skip to content

Cherry-pick #9856 to 6.x: Add docker event metricset#9962

Merged
exekias merged 4 commits intoelastic:6.xfrom
exekias:backport_9856_6.x
Jan 22, 2019
Merged

Cherry-pick #9856 to 6.x: Add docker event metricset#9962
exekias merged 4 commits intoelastic:6.xfrom
exekias:backport_9856_6.x

Conversation

@exekias
Copy link
Copy Markdown
Contributor

@exekias exekias commented Jan 9, 2019

Cherry-pick of PR #9856 to 6.x branch. Original message:

This metricset will retrieve events coming from the Docker events
API [0].

Example output:

"docker": {
  "event": {
    "id": "8c229155b039c2adcb4fab1f987f35a0d1f913dfaa95f3113ed6e4f91eb5398c",
    "from": "busybox",
    "type": "container",
    "action": "die",
    "actor": {
      "id": "8c229155b039c2adcb4fab1f987f35a0d1f913dfaa95f3113ed6e4f91eb5398c",
      "attributes": {
        "image": "busybox",
        "name": "distracted_lichterman",
        "exitCode": "0"
      }
    },
    "time": "2019-01-02T22:41:02.000Z",
    "status": "die"
  }
}

Actor attributes will contain labels in the case of container
events, the module will perform dedotting (if enabled) on them.

[0] https://docs.docker.com/engine/api/v1.37/#operation/SystemEvents

closes #6799

@exekias
Copy link
Copy Markdown
Contributor Author

exekias commented Jan 9, 2019

tests are failing because some ECS fields are not present in 6.x, currently investigating

@exekias
Copy link
Copy Markdown
Contributor Author

exekias commented Jan 10, 2019

I will remove aliases from this change for the backport

@ruflin
Copy link
Copy Markdown
Contributor

ruflin commented Jan 10, 2019

@exekias Great. After thinking a bit more about this I suggest to also open a PR against master and remove them there too.

* Add docker `event` metricset

This metricset will retrieve events coming from the Docker events
API [0].

Example output:

```
"docker": {
  "event": {
    "id": "8c229155b039c2adcb4fab1f987f35a0d1f913dfaa95f3113ed6e4f91eb5398c",
    "from": "busybox",
    "type": "container",
    "action": "die",
    "actor": {
      "id": "8c229155b039c2adcb4fab1f987f35a0d1f913dfaa95f3113ed6e4f91eb5398c",
      "attributes": {
        "image": "busybox",
        "name": "distracted_lichterman",
        "exitCode": "0"
      }
    },
    "time": "2019-01-02T22:41:02.000Z",
    "status": "die"
  }
}
```

Actor attributes will container labels in the case of container
events, the module will perform dedotting (if enabled) on them.

[0] https://docs.docker.com/engine/api/v1.37/#operation/SystemEvents

* Add tests

* Update changelog

* Add missing header

* Add missing file

* Adapt to ECS

* Use a cheaper event for tests

* Close docker client on module shutdown

* Update data

* clean created container

* fix image pull

(cherry picked from commit eef102d)
* Move back docker event fields to it's namespace
@exekias
Copy link
Copy Markdown
Contributor Author

exekias commented Jan 18, 2019

updated to include #10073

@exekias exekias requested a review from a team January 18, 2019 20:26
@ruflin
Copy link
Copy Markdown
Contributor

ruflin commented Jan 21, 2019

jenkins, test this

@exekias
Copy link
Copy Markdown
Contributor Author

exekias commented Jan 21, 2019

jenkins, test this please

@exekias exekias merged commit e69b7b1 into elastic:6.x Jan 22, 2019
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants