# Add\_kubernetes\_metadata + rename = disappearing field?

**URL:** <https://discuss.elastic.co/t/add-kubernetes-metadata-rename-disappearing-field/140160>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [July 16, 2018, 2:19pm UTC](https://discuss.elastic.co/t/add-kubernetes-metadata-rename-disappearing-field/140160 "2018-07-16T14:19:05Z")\
**Posts on this page:** 8\
**Page:** 2

<div class="post-metadata">

**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\
**Post date:** [August 23, 2018, 11:36am UTC](https://discuss.elastic.co/t/add-kubernetes-metadata-rename-disappearing-field/140160/22 "2018-08-23T11:36:22Z")

</div>

Compiling the existing source should be pretty simple. Run `go build` inside the Filebeat directory and it should create the necessary binary. Let me know if you hit some issues.

If that doesn't work I think I could create you a binary with the logs but Docker image would get a bit trickier.

---

<div class="post-metadata">

**Author:** ![tallavi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tallavi/32/73613_2.png) [@tallavi](https://discuss.elastic.co/u/tallavi)\
**Post date:** [August 23, 2018, 11:54am UTC](https://discuss.elastic.co/t/add-kubernetes-metadata-rename-disappearing-field/140160/23 "2018-08-23T11:54:25Z")

</div>

> [@ruflin](#):
>
> If that doesn't work I think I could create you a binary with the logs but Docker image would get a bit trickier.

The simplest thing for me is if you'll give me a compiled binary to replace inside my existing docker image. You probably already know which logs you want to add and have the dev env for compilation.

If that works for you - awesome. If not, I'll try to compile it myself, but it might take a while..

Tal

---

<div class="post-metadata">

**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\
**Post date:** [August 23, 2018, 12:21pm UTC](https://discuss.elastic.co/t/add-kubernetes-metadata-rename-disappearing-field/140160/24 "2018-08-23T12:21:24Z")

</div>

What is the target platform? Are you using the default docker images?

---

<div class="post-metadata">

**Author:** ![tallavi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tallavi/32/73613_2.png) [@tallavi](https://discuss.elastic.co/u/tallavi)\
**Post date:** [August 24, 2018, 6:51am UTC](https://discuss.elastic.co/t/add-kubernetes-metadata-rename-disappearing-field/140160/25 "2018-08-24T06:51:05Z")

</div>

> [@ruflin](#):
>
> Are you using the default docker images?

Yep. So I see it's centos 7?

---

<div class="post-metadata">

**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\
**Post date:** [August 27, 2018, 8:23am UTC](https://discuss.elastic.co/t/add-kubernetes-metadata-rename-disappearing-field/140160/26 "2018-08-27T08:23:53Z")

</div>

Here is the binary generated from master: [https://drive.google.com/open?id=1c2RhO-52x9vGMTeFzXVBEAnwQubcrfTJ](https://drive.google.com/open?id=1c2RhO-52x9vGMTeFzXVBEAnwQubcrfTJ)

The change I applied with additional log entries you can find here: [https://github.com/elastic/beats/commit/b81b495edb3af4a79f1221e4d954cf18b711989f](https://github.com/elastic/beats/commit/b81b495edb3af4a79f1221e4d954cf18b711989f)

---

<div class="post-metadata">

**Author:** ![tallavi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tallavi/32/73613_2.png) [@tallavi](https://discuss.elastic.co/u/tallavi)\
**Post date:** [August 28, 2018, 3:56pm UTC](https://discuss.elastic.co/t/add-kubernetes-metadata-rename-disappearing-field/140160/27 "2018-08-28T15:56:04Z")

</div>

I replaced the binary, put debug logs, removed my workaround, ran it, and..

everything works correctly. No missing fields

Is your binary closer to 6.4.0 or based on 6.4.0? Is it possible the issue was already resolved there somehow?

I think that the next move is to try to reproduce the issue on normal 6.4.0?

---

<div class="post-metadata">

**Author:** ![tallavi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tallavi/32/73613_2.png) [@tallavi](https://discuss.elastic.co/u/tallavi)\
**Post date:** [August 29, 2018, 7:52am UTC](https://discuss.elastic.co/t/add-kubernetes-metadata-rename-disappearing-field/140160/28 "2018-08-29T07:52:18Z")

</div>

I now realized my test was inaccurate as I not tested it on a kubernetes instance (as it's simpler to change the binary in an isolated instance I have). I'll run the test again correctly and report back.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 26, 2018, 7:52am UTC](https://discuss.elastic.co/t/add-kubernetes-metadata-rename-disappearing-field/140160/29 "2018-09-26T07:52:21Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.

[Previous page](https://discuss.elastic.co/t/add-kubernetes-metadata-rename-disappearing-field/140160.md?page=1)
