After this, the memory usage becomes low and the filebeat not restarted anymore.
Could anyone please help in getting the below details:
Do disabling this default matchers processor have any impact on log processing and shipment to logstash/elasticsearch or in kibana UI visualization?
Why this default matchers processor is causing very high memory usage?
Also, in kibana could see the log events are available with metadata info even after disabling default matcher processor. So, what's the actual use of
default matcher processor?
Is there any other way to decrease the memory usage caused by metadata attached to events rather than disabling default matchers processor ?
Asking just for my knowledge, In 7.9.0 after disabling "default_matchers" in add_kubernetes_metadata processor will filebeat be able to collect metadata info ?
But even after disabling default_matchers, I'm able to see metadata info from kibana. Bit confused here.
Will the kubernetes provider adds metadata by default in filebeat 7.9.0 without add_kubernetes_metadata processor or it won't. Could anyone please confirm this ?
According to the documentation, this processors has two building blocks, indexers and matchers, so I'm assuming you need to disable both as mentioned in the documentation.
This behaviour can be disabled by disabling default indexers and matchers in the configuration:
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.