Getting external IP from gke node

Elastic Stack Beats
#1

Hi
I am running beats on GKE and wondering whether its possible to get the external IP of the node that i am running on with the

processors:
   - add_host_metadata:

what i am getting now is the internal google ip which is really not much of an interest for me

image

I have a lot of clusters spread around the world and wanted to use geoip to map them on an interactive kibana map
I have been googling for a couple of hours already , but dont see to see anyone who asked about that somewhere.

#2

Hi! I haven't tried this myself but maybe other processors will give the IP information you need?! For example add_kubernetes_metadata or add_cloud_metadata.

#3

I am just going to put that here in case someone needs it.
I am basically maintaining my own Filebeat image now.

Dockerfile

ARG ES_VERSION
FROM docker.elastic.co/beats/filebeat:${ES_VERSION}
COPY entrypoint-override.sh /usr/local/bin/docker-entrypoint-override
USER root
RUN chmod u+x /usr/local/bin/docker-entrypoint-override
USER filebeat
ENTRYPOINT ["/usr/local/bin/docker-entrypoint-override"]

entrypoint-override.sh

#!/bin/sh

external_ip=$(curl --silent -H "Metadata-Flavor: Google" http://metadata.google.internal/computeMetadata/v1/instance/network-interfaces/0/access-configs/0/external-ip)

if [ "$external_ip" != "Not Found" ]; then
  export EXTERNAL_IP="$external_ip"
  echo "setting external IP to $external_ip"
fi;

exec "/usr/local/bin/docker-entrypoint" "$@"

Then you can use a simple add_field processor

      - add_fields:
          target: host
          fields:
            external_ip: ${EXTERNAL_IP:not_found}