# Auditbeat doesn't embed kubernetes metadata in the events

**URL:** <https://discuss.elastic.co/t/auditbeat-doesnt-embed-kubernetes-metadata-in-the-events/192281>\
**Category:** Beats\
**Tags:** auditbeat\
**Created:** [July 25, 2019, 3:50pm UTC](https://discuss.elastic.co/t/auditbeat-doesnt-embed-kubernetes-metadata-in-the-events/192281 "2019-07-25T15:50:41Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![nickbabkin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nickbabkin/32/57493_2.png) [@nickbabkin](https://discuss.elastic.co/u/nickbabkin)\
**Post date:** [July 25, 2019, 3:50pm UTC](https://discuss.elastic.co/t/auditbeat-doesnt-embed-kubernetes-metadata-in-the-events/192281/1 "2019-07-25T15:50:41Z")

</div>

Hello!  
We have installed auditbeat v.7.2 as daemonset on our kubernetes cluster and enabled kubernetes metadata as instructed here:

[https://www.elastic.co/guide/en/beats/auditbeat/6.7/add-kubernetes-metadata.html](https://www.elastic.co/guide/en/beats/auditbeat/6.7/add-kubernetes-metadata.html)

And the current configuration is:

```
processors:
- add_kubernetes_metadata:
    in_cluster: true
- add_cloud_metadata: null

```

Though auditbeat correctly sends cloud\_metadata to elastic, it doesn't work quite well with kubernetes metadata: it just doesn't send it at all despite the fact that module seems to be enabled in the configuration.

There are no warnings or errors in the debug logfile, and we can see that the module is getting successfully loaded:

`2019-07-25T08:14:06.003Z DEBUG [processors] processors/processor.go:93 Generated new processors: add_kubernetes_metadata, add_cloud_metadata`

Can anyone help with this? Were there any bugs related to kubernetes introduced in recent auditbeat versions?

Thank you.

---

<div class="post-metadata">

**Author:** ![nickbabkin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nickbabkin/32/57493_2.png) [@nickbabkin](https://discuss.elastic.co/u/nickbabkin)\
**Post date:** [August 2, 2019, 1:32pm UTC](https://discuss.elastic.co/t/auditbeat-doesnt-embed-kubernetes-metadata-in-the-events/192281/2 "2019-08-02T13:32:50Z")

</div>

Anyone please?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 23, 2019, 1:32pm UTC](https://discuss.elastic.co/t/auditbeat-doesnt-embed-kubernetes-metadata-in-the-events/192281/3 "2019-08-23T13:32:52Z")

</div>

This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.