Edge Delta with Docker Containers

Overview

This input type allows you to specify a set of Docker containers for Edge Delta to monitor.

To have the agent process lines for a specific line separation rule, you need to define a “line_pattern” regex rule. When you define a “line_pattern” regex rule, the agent will not process lines for New Line("\n"). To learn more, see MultiLine Detection.

Example

containers:
  - labels: "nginx,errorcheck"
    include:
      - "image=gitlab/nginx:latest"
  - labels: "billing,billing-ui,errorcheck"
    include:
      - "image=billing-dashboard:.*"
    enable_incoming_line_anomalies: true
  - labels: "errorcheck"
    include:
      - "image=.*"
    auto_detect_line_pattern: true
  - labels: "apache-web"
    include:
      - "name=apache*,image=.*latest$"
    exclude:
      - "image=.*nginx.*"
      - "name=.*nginx.*"
    line_pattern: '^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}'

Required Parameters

labels

Enter a descriptive label for this input. When you create a workflow, you will use this label to enter your input into the workflow.

inputs:
  containers:
    - labels: "<input name>"

Optional Parameters

auto_detect_line_pattern

Enter true to enable auto line detection for log messages with multiple lines.

inputs:
  containers:
    - labels: "<input name>"
      auto_detect_line_pattern: true

boost_stacktrace_detection

Enter true to fallback (troubleshoot) missing content that resulted from the auto_detect_line_pattern parameter.

inputs:
  containers:
    - labels: "<input name>"
      auto_detect_line_pattern: true
      boost_stacktrace_detection: true

enable_incoming_line_anomalies

Enter true to generate anomaly scores.

inputs:
  containers:
    - labels: "<input name>"
      enable_incoming_line_anomalies: true

exclude

If exclude is specified it drops some logs that match its Golang regex rules. To specify which input to add, you must provide a Golang regex pattern. Comma separated values indicate AND rules, while separate rules indicate OR matching. In this example logs that match rule-1 and rule-2 are excluded. Logs that match rule-3 are also excluded. A log matching only rule-1 would not be excluded.

• If neither include nor exclude are specified, then everything from the input is passed.
• If include is specified as well as exclude, then logs matching in include are passed unless they are dropped by exclude.

inputs:
  containers:
    - labels: "<input name>"
      exclude:
        - "rule-1,rule-2"
        - "rule-3"

filters

Enter an existing filter to add to this input. To learn how to create a filter, see Filters.

inputs:
  containers:
    - labels: "<input name>"
      filters:
        - info

include

If include is specified it only passes matching logs, dropping all others. It is specified with a Golang regex pattern. Comma separated values indicate AND rules, while separate rules indicate OR matching. In this example logs that match rule-1 and rule-2 are excluded. Logs that match rule-3 are also excluded. A log matching only rule-1 would not be excluded.

• If neither include nor exclude are specified, then everything from the input is passed.
• If include is specified as well as exclude, then logs matching in include are passed unless they are dropped by exclude.

inputs:
  containers:
    - labels: "<input name>"
      include:
        - "rule-1,rule-2"
        - "rule-3"