When using filebeat in a Kubernetes cluster as a pod, using the add_kubernetes_metadata processor, the processor can't handle IPv6 addresses if an IPv6 address resolves from https://kubernetes.default.svc.cluster.local. The parser freaks out on the colons in the address. I don't know if this is an issue in an underlying library or Filebeat itself.
Secondary to this issue, it would be nice to provide a custom Kubernetes API endpoint to use, so I could try something like https://[2001:0db8:85a3:0000:0000:8a2e:0370:7334]:443 (and force the use of brackets). It looks like I can only do this if I set in_cluster to "false" and provide a kubeconfig file.