Auditbeat doesn't embed kubernetes metadata in the events

We have installed auditbeat v.7.2 as daemonset on our kubernetes cluster and enabled kubernetes metadata as instructed here:

And the current configuration is:

- add_kubernetes_metadata:
    in_cluster: true
- add_cloud_metadata: null

Though auditbeat correctly sends cloud_metadata to elastic, it doesn't work quite well with kubernetes metadata: it just doesn't send it at all despite the fact that module seems to be enabled in the configuration.

There are no warnings or errors in the debug logfile, and we can see that the module is getting successfully loaded:

2019-07-25T08:14:06.003Z DEBUG [processors] processors/processor.go:93 Generated new processors: add_kubernetes_metadata, add_cloud_metadata

Can anyone help with this? Were there any bugs related to kubernetes introduced in recent auditbeat versions?

Thank you.

Anyone please?

This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.