ECS-Kibana issue: is it possible to combine dynamic filter for kubernetes.pod.name or kubernetes.container._module.pod.name

[asp]

@simianhacker thanks for your reply.
I am using following workaround now:

I ship metricbeat probes to logstash, where I copy lables, namespace, pod.name, etc. from the _module object to kubernetes root. Then I am able to filter on the fields like kubernetes.labels.appl or kubernetes.namespace over all events which have this information.

Details can be found here:

Which ways to copy subfields of kubernetes.container._module.labels.* to kubernetes.lables.*?

mutate+copy is a no-op if a field does not exist, so you can compress this down to mutate { copy => { "[kubernetes][container][_module][labels]" => "[kubernetes][labels]" "[kubernetes][container][_module][namespace]" => "[kubernetes][namespace]" "[kubernetes][container][_module][node]" => "[kubernetes][node]" "[kubernetes][container][_module][pod]" => "[kubernetes][pod]" "[kubernetes][pod][_module][labels]" => "[kubern…

Regards, Andreas