# Add\_kubernetes\_metadata in network flow enrich source.ip and destination.ip

**URL:** <https://discuss.elastic.co/t/add-kubernetes-metadata-in-network-flow-enrich-source-ip-and-destination-ip/376876>\
**Category:** Elastic Agent\
**Created:** [April 7, 2025, 3:26pm UTC](https://discuss.elastic.co/t/add-kubernetes-metadata-in-network-flow-enrich-source-ip-and-destination-ip/376876 "2025-04-07T15:26:58Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Farhad\_Salehi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/farhad_salehi/32/142492_2.png) [@Farhad\_Salehi](https://discuss.elastic.co/u/Farhad_Salehi)\
**Post date:** [April 7, 2025, 3:26pm UTC](https://discuss.elastic.co/t/add-kubernetes-metadata-in-network-flow-enrich-source-ip-and-destination-ip/376876/1 "2025-04-07T15:26:58Z")

</div>

i want use add\_kubernetes\_metadata for both source.ip and destination.ip but it just add source.ip information in kubernetes.pod.name and .... and i dont have any data from destinatio.ip.

---

<div class="post-metadata">

**Author:** ![Farhad\_Salehi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/farhad_salehi/32/142492_2.png) [@Farhad\_Salehi](https://discuss.elastic.co/u/Farhad_Salehi)\
**Post date:** [April 8, 2025, 10:36am UTC](https://discuss.elastic.co/t/add-kubernetes-metadata-in-network-flow-enrich-source-ip-and-destination-ip/376876/2 "2025-04-08T10:36:38Z")

</div>

```auto
i use rename like this and problem solved.
  - add_kubernetes_metadata:
      in_cluster: true
      scope: cluster
      matchers:
        - fields:
            lookup_fields:
              - source.ip
  - rename:
      fields:
        - from: kubernetes
          to: source.kubernetes
      ignore_missing: true
      fail_on_error: false
  - add_kubernetes_metadata:
      in_cluster: true
      scope: cluster
      matchers:
        - fields:
            lookup_fields:
              - destination.ip
  - rename:
      fields:
        - from: kubernetes
          to: destination.kubernetes
      ignore_missing: true
      fail_on_error: false

```