I've installed Heartbeat on my Kubernetes cluster (using Elasticsearch as output) on via the Helm chart.
I can't seem to figure out how to add the Kubernetes node name to the output since I want to see how the network performs on each node.
I've read the documentation at https://www.elastic.co/guide/en/beats/heartbeat/current/add-kubernetes-metadata.html without getting anywhere.
Here's what I've done so far:
- add_kubernetes_metadata: in_cluster: true default_indexers.enabled: true default_matchers.enabled: true indexers: - container: null - pod_name: null - pod_uid: null - ip_port: null matchers: - fields: null lookup_fields: - container.id
Result: produces no kubernetes.* fields in output. With that configuration, the fields I get in ES are beat.hostname (the pod name), beat.name, beat.version, host.name (the pod name), and the icmp.* and monitor.* fields that are working fine, not no Kubernetes output.
What am I missing? What's the magic combination of "indexers" and "matchers" (what are they, and where is there a list of them anyway?)
I've also tried adding the process environment (as the NODE_NAME environment variable contains the Kubernetes node name), but that doesn't work either:
- add_process_metadata: match_pids: [system.process.ppid] include_fields: - process.env restricted_fields: true
Docker metadata seems to work fine, however, but it doesn't contain the information I need.
For reference, here's the values file for the helm deployment: https://gist.github.com/fredsted/5f736a6821061d24db4afd83a186f7a6