Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

ECS container ID not being parsed/sent #823

Closed
Nacoma opened this issue Nov 22, 2022 · 6 comments · Fixed by #966
Closed

ECS container ID not being parsed/sent #823

Nacoma opened this issue Nov 22, 2022 · 6 comments · Fixed by #966
Labels
agent-php bug Something isn't working
Milestone

Comments

@Nacoma
Copy link

Nacoma commented Nov 22, 2022

Infrastructure correlation isn't working because the container.id field is not present.

To Reproduce

  • Add elastic-agent to the Elastic Beanstalk host
  • Enable the docker module in metricbeat/elastic-agent
  • Deploy a containerized PHP application to Elastic Beanstalk
  • See
    • The container is incorrectly displayed as a host (duplicated, it's also displayed in containers). This container has no metrics.
    • Traces for the application have no associated infrastructure or metrics.

Expected behavior

  • The container is not duplicated as a host
  • Both host and container are associated with the trace

This is the ingested message received from the application/APM:

{
  "@timestamp": [
    "2022-11-22T22:33:34.985Z"
  ],
  "agent.name": [
    "php"
  ],
  "agent.version": [
    "1.6.1"
  ],
  "data_stream.dataset": [
    "apm"
  ],
  "data_stream.namespace": [
    "develop"
  ],
  "data_stream.type": [
    "traces"
  ],
  "ecs.version": [
    "1.12.0"
  ],
  "event.agent_id_status": [
    "missing"
  ],
  "event.ingested": [
    "2022-11-22T22:33:36.000Z"
  ],
  "event.outcome": [
    "success"
  ],
  "host.hostname": [
    "fcf701cd93a8"
  ],
  "host.ip": [
    "172.17.0.2"
  ],
  "host.name": [
    "fcf701cd93a8"
  ],
  "http.request.method": [
    "POST"
  ],
  "observer.ephemeral_id": [
    "6ddef0a9-c6d4-4398-a08c-1c525d41e645"
  ],
  "observer.hostname": [
    "ip-blah.ec2.internal"
  ],
  "observer.id": [
    "77dcda3d-0f0e-4721-88fb-bad936adaaa3"
  ],
  "observer.type": [
    "apm-server"
  ],
  "observer.version": [
    "8.5.1"
  ],
  "process.pid": [
    53
  ],
  "processor.event": [
    "transaction"
  ],
  "processor.name": [
    "transaction"
  ],
  "service.environment": [
    "develop"
  ],
  "service.language.name": [
    "PHP"
  ],
  "service.language.version": [
    "8.1.12"
  ],
  "service.name": [
    "Api"
  ],
  "service.node.name": [
    "fcf701cd93a8"
  ],
  "service.runtime.name": [
    "PHP"
  ],
  "service.runtime.version": [
    "8.1.12"
  ],
  "timestamp.us": [
    1669156414985718
  ],
  "trace.id": [
    "57cfce17b3fc98f6f7405f60bd2ae45d"
  ],
  "transaction.duration.us": [
    111750
  ],
  "transaction.id": [
    "f473bb3a724dc27c"
  ],
  "transaction.name": [
    "POST /"
  ],
  "transaction.name.text": [
    "POST /"
  ],
  "transaction.result": [
    "HTTP 4xx"
  ],
  "transaction.sampled": [
    true
  ],
  "transaction.span_count.started": [
    0
  ],
  "transaction.type": [
    "request"
  ],
  "url.domain": [
  ],
  "url.full": [
  ],
  "url.full.text": [
  ],
  "url.original": [
  ],
  "url.original.text": [
  ],
  "url.path": [
    "/"
  ],
  "url.scheme": [
    "http"
  ],
  "_id": "Kwt5oYQBq_2iaxTGqjNm",
  "_index": ".ds-traces-apm-develop-2022.11.22-000001",
  "_score": null
}

Metricbeat (elastic-agent), installed on the host, is correctly identifying the containers:

{
  "_index": ".ds-metrics-docker.container-develop-2022.11.22-000001",
  "_id": "_wuCoYQBq_2iaxTGSz52",
  "_version": 1,
  "_score": null,
  "fields": {
    "elastic_agent.version": [
      "8.5.1"
    ],
    "host.os.name.text": [
      "Amazon Linux"
    ],
    "host.hostname": [
      "ip-blah.ec2.internal"
    ],
    "host.mac": [
      "02-42-C2-AB-8F-BF",
      "02-6B-A7-10-33-CF",
      "42-7C-4E-97-2D-45",
      "CA-C4-80-19-42-B1"
    ],
    "docker.container.size.rw": [
      0
    ],
    "container.id": [
      "fcf701cd93a80cd5ae1ead16a80b871b0daea72d59868661b8bbef39d79dc1e6"
    ],
    "cloud.availability_zone": [
      "us-east-1a"
    ],
    "service.type": [
      "docker"
    ],
    "container.name": [
    ],
    "docker.container.labels.com_amazonaws_ecs_container-name": [
      "app"
    ],
    "container.image.name": [
    ],
    "host.os.version": [
      "2"
    ],
    "host.os.name": [
      "Amazon Linux"
    ],
    "agent.name": [
      "ip-blah.ec2.internal"
    ],
    "host.name": [
      "ip-blah.ec2.internal"
    ],
    "event.agent_id_status": [
      "verified"
    ],
    "docker.container.ip_addresses": [
      "172.17.0.2"
    ],
    "cloud.region": [
      "us-east-1"
    ],
    "host.os.type": [
      "linux"
    ],
    "data_stream.type": [
      "metrics"
    ],
    "docker.container.command": [
      "docker-php-entrypoint entrypoint"
    ],
    "host.architecture": [
      "x86_64"
    ],
    "cloud.machine.type": [
      "t3a.2xlarge"
    ],
    "cloud.provider": [
      "aws"
    ],
    "container.runtime": [
      "docker"
    ],
    "cloud.service.name": [
      "EC2"
    ],
    "agent.id": [
      "0c019f2c-a7a8-4d00-ab78-0d3bd41e4b93"
    ],
    "host.containerized": [
      false
    ],
    "ecs.version": [
      "8.0.0"
    ],
    "service.address": [
      "unix:///var/run/docker.sock"
    ],
    "docker.container.labels.com_amazonaws_ecs_task-arn": [
    ],
    "agent.version": [
      "8.5.1"
    ],
    "host.os.family": [
      "redhat"
    ],
    "docker.container.status": [
      "Up 34 minutes"
    ],
    "docker.container.labels.com_amazonaws_ecs_task-definition-version": [
      "410"
    ],
    "docker.container.created": [
      "2022-11-22T22:08:43.000Z"
    ],
    "docker.container.labels.com_amazonaws_ecs_task-definition-family": [
    ],
    "cloud.instance.id": [
      "i-0ca7c5a56b11067bf"
    ],
    "host.ip": [
      "10.0.1.253",
      "fe80::6b:a7ff:fe10:33cf",
      "172.17.0.1",
      "fe80::42:c2ff:feab:8fbf",
      "fe80::c8c4:80ff:fe19:42b1",
      "fe80::407c:4eff:fe97:2d45"
    ],
    "agent.type": [
      "metricbeat"
    ],
    "docker.container.labels.role": [
      "php"
    ],
    "event.module": [
      "docker"
    ],
    "host.os.kernel": [
      "4.14.275-207.503.amzn2.x86_64"
    ],
    "elastic_agent.snapshot": [
      false
    ],
    "host.id": [
      "9055fc78a53c4749b759e32a794d060f"
    ],
    "elastic_agent.id": [
      "0c019f2c-a7a8-4d00-ab78-0d3bd41e4b93"
    ],
    "data_stream.namespace": [
      "develop"
    ],
    "metricset.period": [
      10000
    ],
    "host.os.codename": [
      "Karoo"
    ],
    "event.duration": [
      2777816
    ],
    "metricset.name": [
      "container"
    ],
    "cloud.image.id": [
      "ami-03297dd2c45657fd8"
    ],
    "event.ingested": [
      "2022-11-22T22:43:01.000Z"
    ],
    "docker.container.size.root_fs": [
      0
    ],
    "@timestamp": [
      "2022-11-22T22:43:00.619Z"
    ],
    "host.os.platform": [
      "amzn"
    ],
    "cloud.account.id": [
      "121952031047"
    ],
    "data_stream.dataset": [
      "docker.container"
    ],
    "agent.ephemeral_id": [
      "b7ab80e1-fbe5-43b6-9bcc-ed55093f9d4b"
    ],
    "event.dataset": [
      "docker.container"
    ],
    "docker.container.labels.com_amazonaws_ecs_cluster": [
      "awseb-development-api-uimmpxrb6e"
    ]
  },
  "highlight": {
    "container.id": [
      "@kibana-highlighted-field@fcf701cd93a80cd5ae1ead16a80b871b0daea72d59868661b8bbef39d79dc1e6@/kibana-highlighted-field@"
    ]
  },
  "sort": [
    1669156980619
  ]
}

May be a different container ID now, but /proc/self/cgroup contains:

1:name=systemd:/ecs/9f72a38d047c4c4ab178664194e837c2/fcf701cd93a80cd5ae1ead16a80b871b0daea72d59868661b8bbef39d79dc1e6
@Nacoma Nacoma added the bug Something isn't working label Nov 22, 2022
@Nacoma
Copy link
Author

Nacoma commented Nov 30, 2022

Tangentially related, docker uses cgroup v2 (since docker 20.10) which does not expose the container ID in /proc/self/cgroup. Using cgroup v2 is configurable, but some contexts (eg docker-desktop) use it by default.

Instead, it looks like the container ID can be resolved from /proc/self/mountinfo in all versions. The same regex (/\/docker\/containers\/(\w+)\//) works in ECS as well.

@Nacoma
Copy link
Author

Nacoma commented Jan 9, 2023

Looks like this has come up in various elastic apm repos (elastic/apm-agent-python#1691, elastic/apm#523). elastic/apm#523 (comment) is exactly the issue that we're running into.

@zobo
Copy link
Contributor

zobo commented May 17, 2023

Proposed PR #966

@SergeyKleyman
Copy link
Contributor

Implemented by #966

@SergeyKleyman
Copy link
Contributor

@Nacoma Hi. We implemented capturing container ID in PRs #966 and #975 and it's already merged to main branch. Please try it out and let us know if it works on a AWS ECS container. Also if you could provide examples of /proc/self/cgroup and /proc/self/mountinfo content from AWS ECS container that would allow us to add that dataset to the unit test to catch potential regressions in the future.

@Nacoma
Copy link
Author

Nacoma commented May 31, 2023

@SergeyKleyman

We implemented capturing container ID in PRs #966 and #975 and it's already merged to main branch.

That's wonderful! We have tickets in place to move to the new version. I appreciate the work you all are doing on this.

Also if you could provide examples of /proc/self/cgroup and /proc/self/mountinfo content from AWS ECS container that would allow us to add that dataset to the unit test to catch potential regressions in the future.

Absolutely!

bash-5.1$ cat /proc/self/mountinfo
221 113 0:38 / / rw,relatime master:61 - overlay overlay rw,lowerdir=/var/lib/docker/overlay2/l/LB63KJDCKVAGBBPXYROZX7JVAM:/var/lib/docker/overlay2/l/BVNPSN6Q6TYLNI2OHZWHTONQCY:/var/lib/docker/overlay2/l/X44I4X7YEIYQJQXO37U6P5DT6A:/var/lib/docker/overlay2/l/VJRZYCUF7DPR4R6RK4UL4SL6NG:/var/lib/docker/overlay2/l/2ODUSNSXD72XMD2FHZLCEIJZAG:/var/lib/docker/overlay2/l/YFYBKJUGA5QYPPNINOVVH2XOA4:/var/lib/docker/overlay2/l/U26ZYH2HQOKVGHCRY6O7N5II3V:/var/lib/docker/overlay2/l/JPHJFVCMI65D7ZNH4UBOKU7N6T:/var/lib/docker/overlay2/l/UVP75O73XHQCIDGZHQMJ43NSTG:/var/lib/docker/overlay2/l/JUUA3TYG6CC667ALFT75P4N36O:/var/lib/docker/overlay2/l/MMEXQLYH6QKEK4C3KWH25X27DM:/var/lib/docker/overlay2/l/4KMSKDQNAYQWCZRMGEFAINCVBT:/var/lib/docker/overlay2/l/Y3FK5XJATP4YDBBB2AYK3E5MK4:/var/lib/docker/overlay2/l/MC422ULYVLNVUIYQEQF4O7WSYQ:/var/lib/docker/overlay2/l/BHT7HF3GQSW2AHIIGZBWHAW422:/var/lib/docker/overlay2/l/HTL45WDTBKJJMJCCBY2VF2DTPP:/var/lib/docker/overlay2/l/QQ7Y732UMNN2H3CLTT6RPRI7YG:/var/lib/docker/overlay2/l/AOZL7ABTR7JHFHXPOLZTOHAVJ2:/var/lib/docker/overlay2/l/IACECLNNMDX35D3LJDHYKVTTGC:/var/lib/docker/overlay2/l/XIWRLIGDY3T7NGIYL7TP4FFRDM:/var/lib/docker/overlay2/l/B4OQCGLKMLA43TIJ7GSZHYRCZJ:/var/lib/docker/overlay2/l/RLMQKM54FCVWHKOIFNO3RQXPP6:/var/lib/docker/overlay2/l/OR5WBD6GPVBQQOMGVBA6ZDTXIL:/var/lib/docker/overlay2/l/XFEDB4UMUYTJEV53DYEJQRAG2S:/var/lib/docker/overlay2/l/7PHSVW2LCKORUIQBRG6DH27XDM:/var/lib/docker/overlay2/l/C35VMUOBUUSXGMH2QJQOYTWFT6:/var/lib/docker/overlay2/l/6JSGLPR65IN2FNCF2LLXALB2F2:/var/lib/docker/overlay2/l/2RWWAASWNVH7R3WXT3ZDDNQJGR,upperdir=/var/lib/docker/overlay2/10e3787ccf8a6cf1f8465f309b41df61aed963468142e6b1a78e8bd6089eabfc/diff,workdir=/var/lib/docker/overlay2/10e3787ccf8a6cf1f8465f309b41df61aed963468142e6b1a78e8bd6089eabfc/work
222 221 0:49 / /proc rw,nosuid,nodev,noexec,relatime - proc proc rw
223 221 0:50 / /dev rw,nosuid - tmpfs tmpfs rw,size=65536k,mode=755
224 223 0:51 / /dev/pts rw,nosuid,noexec,relatime - devpts devpts rw,gid=5,mode=620,ptmxmode=666
225 221 0:52 / /sys ro,nosuid,nodev,noexec,relatime - sysfs sysfs ro
226 225 0:53 / /sys/fs/cgroup rw,nosuid,nodev,noexec,relatime - tmpfs tmpfs rw,mode=755
227 226 0:23 /ecs/f0a761cb4b4f48a1ab8bd30c26ba2b5e/837c1bc37405aee683ad65cbc4fe95f5e5e918ac73ae84afb26ddff2415b9367 /sys/fs/cgroup/systemd ro,nosuid,nodev,noexec,relatime master:9 - cgroup cgroup rw,xattr,release_agent=/usr/lib/systemd/systemd-cgroups-agent,name=systemd
228 226 0:25 /ecs/f0a761cb4b4f48a1ab8bd30c26ba2b5e/837c1bc37405aee683ad65cbc4fe95f5e5e918ac73ae84afb26ddff2415b9367 /sys/fs/cgroup/devices ro,nosuid,nodev,noexec,relatime master:10 - cgroup cgroup rw,devices
229 226 0:26 /ecs/f0a761cb4b4f48a1ab8bd30c26ba2b5e/837c1bc37405aee683ad65cbc4fe95f5e5e918ac73ae84afb26ddff2415b9367 /sys/fs/cgroup/freezer ro,nosuid,nodev,noexec,relatime master:11 - cgroup cgroup rw,freezer
230 226 0:27 /ecs/f0a761cb4b4f48a1ab8bd30c26ba2b5e/837c1bc37405aee683ad65cbc4fe95f5e5e918ac73ae84afb26ddff2415b9367 /sys/fs/cgroup/perf_event ro,nosuid,nodev,noexec,relatime master:12 - cgroup cgroup rw,perf_event
231 226 0:28 /ecs/f0a761cb4b4f48a1ab8bd30c26ba2b5e/837c1bc37405aee683ad65cbc4fe95f5e5e918ac73ae84afb26ddff2415b9367 /sys/fs/cgroup/net_cls,net_prio ro,nosuid,nodev,noexec,relatime master:13 - cgroup cgroup rw,net_cls,net_prio
232 226 0:29 /ecs/f0a761cb4b4f48a1ab8bd30c26ba2b5e/837c1bc37405aee683ad65cbc4fe95f5e5e918ac73ae84afb26ddff2415b9367 /sys/fs/cgroup/hugetlb ro,nosuid,nodev,noexec,relatime master:14 - cgroup cgroup rw,hugetlb
233 226 0:30 /ecs/f0a761cb4b4f48a1ab8bd30c26ba2b5e/837c1bc37405aee683ad65cbc4fe95f5e5e918ac73ae84afb26ddff2415b9367 /sys/fs/cgroup/blkio ro,nosuid,nodev,noexec,relatime master:15 - cgroup cgroup rw,blkio
234 226 0:31 /ecs/f0a761cb4b4f48a1ab8bd30c26ba2b5e/837c1bc37405aee683ad65cbc4fe95f5e5e918ac73ae84afb26ddff2415b9367 /sys/fs/cgroup/cpu,cpuacct ro,nosuid,nodev,noexec,relatime master:16 - cgroup cgroup rw,cpu,cpuacct
235 226 0:32 /ecs/f0a761cb4b4f48a1ab8bd30c26ba2b5e/837c1bc37405aee683ad65cbc4fe95f5e5e918ac73ae84afb26ddff2415b9367 /sys/fs/cgroup/memory ro,nosuid,nodev,noexec,relatime master:17 - cgroup cgroup rw,memory
236 226 0:33 /ecs/f0a761cb4b4f48a1ab8bd30c26ba2b5e/837c1bc37405aee683ad65cbc4fe95f5e5e918ac73ae84afb26ddff2415b9367 /sys/fs/cgroup/pids ro,nosuid,nodev,noexec,relatime master:18 - cgroup cgroup rw,pids
237 226 0:34 /ecs/f0a761cb4b4f48a1ab8bd30c26ba2b5e/837c1bc37405aee683ad65cbc4fe95f5e5e918ac73ae84afb26ddff2415b9367 /sys/fs/cgroup/cpuset ro,nosuid,nodev,noexec,relatime master:19 - cgroup cgroup rw,cpuset
238 223 0:48 / /dev/mqueue rw,nosuid,nodev,noexec,relatime - mqueue mqueue rw
239 221 259:2 /var/lib/docker/volumes/ecs-awseb-production-api-fallback-3yfu5e2ypu-288-app-80cab7a2d8bbe9db6600/_data /app rw,noatime master:1 - xfs /dev/nvme0n1p1 rw,attr2,inode64,noquota
240 221 259:2 /opt/elasticbeanstalk /opt/elasticbeanstalk rw,noatime - xfs /dev/nvme0n1p1 rw,attr2,inode64,noquota
241 221 259:2 /var/lib/docker/containers/837c1bc37405aee683ad65cbc4fe95f5e5e918ac73ae84afb26ddff2415b9367/resolv.conf /etc/resolv.conf rw,noatime - xfs /dev/nvme0n1p1 rw,attr2,inode64,noquota
242 221 259:2 /var/lib/docker/containers/837c1bc37405aee683ad65cbc4fe95f5e5e918ac73ae84afb26ddff2415b9367/hostname /etc/hostname rw,noatime - xfs /dev/nvme0n1p1 rw,attr2,inode64,noquota
243 221 259:2 /var/lib/docker/containers/837c1bc37405aee683ad65cbc4fe95f5e5e918ac73ae84afb26ddff2415b9367/hosts /etc/hosts rw,noatime - xfs /dev/nvme0n1p1 rw,attr2,inode64,noquota
244 223 0:47 / /dev/shm rw,nosuid,nodev,noexec,relatime - tmpfs shm rw,size=65536k
245 239 259:2 /var/app/current/storage/dotcom-238617-027ac5859c01.json /app/storage/dotcom-238617-027ac5859c01.json rw,noatime - xfs /dev/nvme0n1p1 rw,attr2,inode64,noquota
246 239 259:2 /var/log/containers/app /app/storage/logs rw,noatime - xfs /dev/nvme0n1p1 rw,attr2,inode64,noquota
114 222 0:49 /bus /proc/bus ro,nosuid,nodev,noexec,relatime - proc proc rw
115 222 0:49 /fs /proc/fs ro,nosuid,nodev,noexec,relatime - proc proc rw
116 222 0:49 /irq /proc/irq ro,nosuid,nodev,noexec,relatime - proc proc rw
117 222 0:49 /sys /proc/sys ro,nosuid,nodev,noexec,relatime - proc proc rw
118 222 0:49 /sysrq-trigger /proc/sysrq-trigger ro,nosuid,nodev,noexec,relatime - proc proc rw
128 222 0:54 / /proc/acpi ro,relatime - tmpfs tmpfs ro
131 222 0:50 /null /proc/kcore rw,nosuid - tmpfs tmpfs rw,size=65536k,mode=755
134 222 0:50 /null /proc/keys rw,nosuid - tmpfs tmpfs rw,size=65536k,mode=755
136 222 0:50 /null /proc/latency_stats rw,nosuid - tmpfs tmpfs rw,size=65536k,mode=755
150 222 0:50 /null /proc/timer_list rw,nosuid - tmpfs tmpfs rw,size=65536k,mode=755
151 222 0:50 /null /proc/sched_debug rw,nosuid - tmpfs tmpfs rw,size=65536k,mode=755
152 225 0:55 / /sys/firmware ro,relatime - tmpfs tmpfs ro
bash-5.1$ cat /proc/self/cgroup 
11:cpuset:/ecs/f0a761cb4b4f48a1ab8bd30c26ba2b5e/837c1bc37405aee683ad65cbc4fe95f5e5e918ac73ae84afb26ddff2415b9367
10:pids:/ecs/f0a761cb4b4f48a1ab8bd30c26ba2b5e/837c1bc37405aee683ad65cbc4fe95f5e5e918ac73ae84afb26ddff2415b9367
9:memory:/ecs/f0a761cb4b4f48a1ab8bd30c26ba2b5e/837c1bc37405aee683ad65cbc4fe95f5e5e918ac73ae84afb26ddff2415b9367
8:cpu,cpuacct:/ecs/f0a761cb4b4f48a1ab8bd30c26ba2b5e/837c1bc37405aee683ad65cbc4fe95f5e5e918ac73ae84afb26ddff2415b9367
7:blkio:/ecs/f0a761cb4b4f48a1ab8bd30c26ba2b5e/837c1bc37405aee683ad65cbc4fe95f5e5e918ac73ae84afb26ddff2415b9367
6:hugetlb:/ecs/f0a761cb4b4f48a1ab8bd30c26ba2b5e/837c1bc37405aee683ad65cbc4fe95f5e5e918ac73ae84afb26ddff2415b9367
5:net_cls,net_prio:/ecs/f0a761cb4b4f48a1ab8bd30c26ba2b5e/837c1bc37405aee683ad65cbc4fe95f5e5e918ac73ae84afb26ddff2415b9367
4:perf_event:/ecs/f0a761cb4b4f48a1ab8bd30c26ba2b5e/837c1bc37405aee683ad65cbc4fe95f5e5e918ac73ae84afb26ddff2415b9367
3:freezer:/ecs/f0a761cb4b4f48a1ab8bd30c26ba2b5e/837c1bc37405aee683ad65cbc4fe95f5e5e918ac73ae84afb26ddff2415b9367
2:devices:/ecs/f0a761cb4b4f48a1ab8bd30c26ba2b5e/837c1bc37405aee683ad65cbc4fe95f5e5e918ac73ae84afb26ddff2415b9367
1:name=systemd:/ecs/f0a761cb4b4f48a1ab8bd30c26ba2b5e/837c1bc37405aee683ad65cbc4fe95f5e5e918ac73ae84afb26ddff2415b9367

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
agent-php bug Something isn't working
Projects
None yet
Development

Successfully merging a pull request may close this issue.

3 participants