Add_kubernetes_metadata + rename = disappearing field?

Elastic Stack Beats
22

Compiling the existing source should be pretty simple. Run go build inside the Filebeat directory and it should create the necessary binary. Let me know if you hit some issues.

If that doesn't work I think I could create you a binary with the logs but Docker image would get a bit trickier.

23

The simplest thing for me is if you'll give me a compiled binary to replace inside my existing docker image. You probably already know which logs you want to add and have the dev env for compilation.

If that works for you - awesome. If not, I'll try to compile it myself, but it might take a while..

Tal

24

What is the target platform? Are you using the default docker images?

25

Yep. So I see it's centos 7?

26

Here is the binary generated from master: https://drive.google.com/open?id=1c2RhO-52x9vGMTeFzXVBEAnwQubcrfTJ

The change I applied with additional log entries you can find here: https://github.com/elastic/beats/commit/b81b495edb3af4a79f1221e4d954cf18b711989f

27

I replaced the binary, put debug logs, removed my workaround, ran it, and..

everything works correctly. No missing fields

Is your binary closer to 6.4.0 or based on 6.4.0? Is it possible the issue was already resolved there somehow?

I think that the next move is to try to reproduce the issue on normal 6.4.0?

28

I now realized my test was inaccurate as I not tested it on a kubernetes instance (as it's simpler to change the binary in an isolated instance I have). I'll run the test again correctly and report back.

29

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.