We are using filebeat v 7.3 over Kubernetes. Along with pod's logs, we also want to push host logs to elasticsearch. We have mounted "/var/log/messages" of host towards the filebeat pod. The logs are successfully being pushed to elasticsearch but kubernetes metadata is not being added to logs.
Here is my fileabeat input configuration-
- type: docker containers.ids: - "*" multiline.pattern: '^DEBUG' multiline.negate: true multiline.match: 'after' processors: - add_kubernetes_metadata: in_cluster: true - type: log paths: - /var/log/host/messages processors: - add_kubernetes_metadata: in_cluster: true
For the first input type docker, we are getting the Kubernetes metadata but for the second type log, we are not getting any metadata.