# ECK Filebeat processor add\_kubernetes\_metadata does not add fields with kube metadata

**URL:** <https://discuss.elastic.co/t/eck-filebeat-processor-add-kubernetes-metadata-does-not-add-fields-with-kube-metadata/344322>\
**Category:** Beats\
**Tags:** docker, filebeat\
**Created:** [October 3, 2023, 2:52pm UTC](https://discuss.elastic.co/t/eck-filebeat-processor-add-kubernetes-metadata-does-not-add-fields-with-kube-metadata/344322 "2023-10-03T14:52:59Z")\
**Posts on this page:** 1\
**Showing post:** 4

<div class="post-metadata">

**Author:** ![AlekseyD](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alekseyd/32/126032_2.png) [@AlekseyD](https://discuss.elastic.co/u/AlekseyD)\
**Post date:** [October 4, 2023, 3:30pm UTC](https://discuss.elastic.co/t/eck-filebeat-processor-add-kubernetes-metadata-does-not-add-fields-with-kube-metadata/344322/4 "2023-10-04T15:30:30Z")

</div>

The solution has been found! Look at the post

> [@Kubernetes metadata missing with add\_kubernetes\_metadata enabled](https://discuss.elastic.co/t/kubernetes-metadata-missing-with-add-kubernetes-metadata-enabled/254314/6):
>
> @xsb I have been trying and there are some extra things you need to do: You need to indicate the hostname to add\_kubernetes\_metadata. You need to give permissions to this pod to access the Kubernetes API. For the first point, you need to add the host option to add\_kubernetes\_metadata: processors: - add\_kubernetes\_metadata: host: ${NODE\_NAME} matchers: - logs\_path: logs\_path: /var/log/continers/\*.log NODE\_NAME needs to be defined as an environment …

It was necessary to create a service account, configure the correct permissions for it

The final configuration that works for me

```auto
apiVersion: beat.k8s.elastic.co/v1beta1
kind: Beat
metadata:
  name: eck-filebeat
  namespace: eck
spec:
  [...]
  config:
    filebeat.inputs:
    # Ingress-nginx block
    - type: container
      paths:
        - /var/log/containers/*ingress-nginx*.log
      processors:
      - add_kubernetes_metadata:
          host: ${NODE_NAME}
          matchers:
          - logs_path:
              logs_path: "/var/log/containers/"
    # Java apps block
    - type: container
      paths:
        - /var/log/containers/*mp-dev*.log
        - /var/log/containers/*mp-rc*.log
      [...]
      processors:
      - add_kubernetes_metadata:
          host: ${NODE_NAME}
          matchers:
          - logs_path:
              logs_path: "/var/log/containers/"
      [...]
  daemonSet:
    podTemplate:
      spec:
        serviceAccount: elastic-beat-filebeat
        automountServiceAccountToken: true
        dnsPolicy: ClusterFirstWithHostNet
        hostNetwork: false
        securityContext:
          runAsUser: 0
        containers:
        - name: filebeat
          volumeMounts:
          - name: varlogcontainers
            mountPath: /var/log/containers
          - name: varlogpods
            mountPath: /var/log/pods
          - name: varlibdockercontainers
            mountPath: /var/lib/docker/containers
          env:
          - name: NODE_NAME
            valueFrom:
              fieldRef:
                fieldPath: spec.nodeName
        volumes:
        - name: varlogcontainers
          hostPath:
            path: /var/log/containers
        - name: varlogpods
          hostPath:
            path: /var/log/pods
        - name: varlibdockercontainers
          hostPath:
            path: /var/lib/docker/containers
        tolerations:
          - key: "type"
            operator: "Equal"
            value: "monitoring"
            effect: "NoSchedule"
          - key: "node-role.kubernetes.io/master"
            operator: "Exists"
            effect: "NoSchedule"
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: elastic-beat-filebeat
  namespace: eck
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: elastic-beat-autodiscover-binding
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: elastic-beat-autodiscover
subjects:
- kind: ServiceAccount
  name: elastic-beat-filebeat
  namespace: eck
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: elastic-beat-autodiscover
rules:
- apiGroups:
  - ""
  - apps
  - batch
  resources:
  - nodes
  - namespaces
  - events
  - pods
  - replicasets
  - jobs
  verbs:
  - get
  - list
  - watch

```

---

_[View the full topic](https://discuss.elastic.co/t/eck-filebeat-processor-add-kubernetes-metadata-does-not-add-fields-with-kube-metadata/344322)._