I'm trying to use hints-based autodiscover with Filebeat 6.4.2 inside Kubernetes.
The basic setup is working (through some trials and tribulations noted in earlier messages in this forum). However, now I'm trying to enable hints-based parsing of various inputs.
The first I'm trying to setup as I figured it would be the easiest, is the kibana module. I've added the annotation
co.elastic.logs/module: kibana on the kibana pods. I've confirmed filebeat is seeing this annotation -- it gets indexed in ES and is visible in the Kibana UI:
message value is still the unparsed JSON -- and none of the structured values I would expect after passing through the kibana module:
I've also tried the apache2 and elasticsearch modules, with similar no-op results.
The modules seem to be enabled inside filebeat:
2018-11-01T23:34:33.758Z INFO beater/filebeat.go:98 Enabled modules/filesets: kibana (log), kafka (log), (), apache2 (access, error), elasticsearch (slowlog, audit, deprecation, gc, server)
What am I missing? How do I enable this?