Add_kubernetes_metadata with input type log

[Vladimir_Rimar]

I'm using filebeat as a side-car container, having input type log. I have also configured:

    processors:
        - add_kubernetes_metadata:
            in_cluster: true

but I'm not getting any metadata like pod, namespace in Elastic. Is this possible with input type log?

[mtojek (Marcin Tojek)]

Your Kubernetes configuration might be slightly different. Could you double-check if container logs are collected in /var/lib/docker/containers/ ?

[Vladimir_Rimar]

I'm using a side-car container in OpenShift, so the logs are not in /var/lib/docker/containers/
Here the input configuration

filebeat.inputs:
- type: log
  paths:
    - /opt/eap/standalone/log/server.log

[mtojek (Marcin Tojek)]

Could you try to set. the logs_path? For reference: https://www.elastic.co/guide/en/beats/filebeat/current/add-kubernetes-metadata.html#_logs_path

[Vladimir_Rimar]

Well, just to make it clear, the log:
in /opt/eap/standalone/log/server.log
doesn't contain any kubernetes metadata. That is the application server log.

I'm trying to do quite a simple thing. I have a pod in which two containers are running ( application container and a filebeat container ). The pod defines also a few labels, like app-name, deploymentConfig name etc. I have also tried to do somethig like:

- add_kubernetes_metadata:
        default_indexers.enabled: false
        default_matchers.enabled: false
        include_labels:
          - app-name

but that is also not working. I don't see a field app-name in elastic.

I can think of workaround that I set an environment variable(s) for filebeat container with namesapce and pod name, and then add them in the filebeat.yml:

fields:
    COMPANY_ID: Red_Hat
    APP_NAME: "hello-world"
    namespace: ${NAMESPACE}
    podname: ${PODNAME}

but I would expect that this can be done differently.