Best way of setting up `` && any other fields that I should set up?

Hi thanks for this product! I wonder how should I set up the What is the most recommended way to setup it for any kubernetes pod (e.g. a Spring java app, a Nginx, a Kafka...)

(Because I see here saying that, I should set up in order to derive the event.dataset so as to see the logs categorized.)

Moreover, I wonder whether there are other fields that I should set up in order to make my life better besides this

Thanks very much!

Hi @fzyzcjy,

you should be able to perform quite a bit of correlation with and event.dataset already. For k8s it might be useful to establish a convention in your environment to add the service name as a label to pods (e.g. app or service_name) and use the add_kubernetes_metadata and copy_field processors in the beats config to retrieve and copy it from (or so) to (and event.dataset in the logs case).

(btw, I wanted to clarify that event.dataset is not derived automatically, but the recommendation is to use the service name plus a type identifier (e.g. my_service.log).)

Does that make sense?

1 Like

Sounds great, Thanks!

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.