Filebeat autodiscover+kubernetes module or add_kubernetes_metadata processor?

Elastic Stack Beats
,
#1

I just set up a new helm chart to use add_kubernetes_metadata processor, which seemed to be the way to get k8s annotations based on my googling. But, in the process of trying to figure out which fields are being added, I came across this forum and some pointers to the autodiscover+kubernetes module configuration. Now I'm all backwards because I don't know which I should be using.

This example, for instance, uses the processor: helm-charts/filebeat at master · elastic/helm-charts · GitHub

Which should I be using? In what circumstances should we choose one over the other?

#2

Hi!

Both ways should work on a base case (collect containers' logs and enrich them with k8s metadata).

You should prefer autodiscover k8s provider, which by default enriches events with k8s metadata, if you are interested to setup specific modules configuration based on templates or hints.

See Autodiscover | Filebeat Reference [7.10] | Elastic and Hints based autodiscover | Filebeat Reference [7.10] | Elastic for more information.

C.