# ECS-Kibana issue: is it possible to combine dynamic filter for kubernetes.pod.name or kubernetes.container.\_module.pod.name **URL:** \ **Category:** Metrics\ **Created:** [August 16, 2019, 8:01am UTC](https://discuss.elastic.co/t/ecs-kibana-issue-is-it-possible-to-combine-dynamic-filter-for-kubernetes-pod-name-or-kubernetes-container-module-pod-name/195449 "2019-08-16T08:01:38Z")\ **Posts on this page:** 1\ **Showing post:** 3
**Author:** ![asp](https://avatars.discourse-cdn.com/v4/letter/a/9fc348/32.png) [@asp](https://discuss.elastic.co/u/asp)\ **Post date:** [August 20, 2019, 6:35am UTC](https://discuss.elastic.co/t/ecs-kibana-issue-is-it-possible-to-combine-dynamic-filter-for-kubernetes-pod-name-or-kubernetes-container-module-pod-name/195449/3 "2019-08-20T06:35:26Z")
@simianhacker thanks for your reply. I am using following workaround now: I ship metricbeat probes to logstash, where I copy lables, namespace, pod.name, etc. from the \_module object to kubernetes root. Then I am able to filter on the fields like kubernetes.labels.appl or kubernetes.namespace over all events which have this information. Details can be found here: > [@Which ways to copy subfields of kubernetes.container.\_module.labels.\* to kubernetes.lables.\*?](https://discuss.elastic.co/t/which-ways-to-copy-subfields-of-kubernetes-container-module-labels-to-kubernetes-lables/195546/5): > > mutate+copy is a no-op if a field does not exist, so you can compress this down to mutate { copy =\> { "[kubernetes][container][\_module][labels]" =\> "[kubernetes][labels]" "[kubernetes][container][\_module][namespace]" =\> "[kubernetes][namespace]" "[kubernetes][container][\_module][node]" =\> "[kubernetes][node]" "[kubernetes][container][\_module][pod]" =\> "[kubernetes][pod]" "[kubernetes][pod][\_module][labels]" =\> "[kubern… Regards, Andreas --- _[View the full topic](https://discuss.elastic.co/t/ecs-kibana-issue-is-it-possible-to-combine-dynamic-filter-for-kubernetes-pod-name-or-kubernetes-container-module-pod-name/195449)._