Getting K8s annotations in Filebeat logs

Elastic Stack Beats
,
1

Hi,

I'm trying to get additional annotations from my K8s deployment into Elasticsearch.
I'm currently on filebeat 7.18.8.
My filebeat imputs in the filebeat.yml file look like the code below

filebeat.inputs:
- type: log
  enabled: true
  exclude_lines:
    # RI-813 OMSAgent is too noisy:
    - '^[A-Z][a-z][a-z] [0-9][0-9] [0-2][0-9]:[0-5][0-9]:[0-5][0-9] [a-zA-Z0-9]* sudo: omsagent : TTY=unknown'
  paths:
  {% for path in filebeat_paths %}
  - {{ path }}
  {% endfor -%}
  exclude_files:
  {% for exclusion in filebeat_exclude_files %}
  - "{{ exclusion }}"
  {% endfor %}
- type: docker
  containers.ids:
  {% if filebeat_kubelet_container_id is defined %}
  - {{ filebeat_kubelet_container_id }}
  {% else %}
  - '*'
  {% endif %}

  # containers.ids: '*'
  containers.path: "{{ filebeat_docker_root_dir }}/containers"
  processors:
    - add_docker_metadata:
        match_source_index: {{ filebeat_match_source_index }}
    - add_kubernetes_metadata:
        in_cluster: false
        host: "{{ ansible_fqdn }}"

my deployment.yml is similar to

apiVersion: apps/v1
kind: Deployment
metadata:
  annotations:
    test: abc
    test/slash: def
  name: somethingforjoey
spec:
  replicas: 1
  selector:
    matchLabels:
      app: somethingforjoey
  template:
    metadata:
      labels:
        app: somethingforjoey
    spec:
      containers:
      - env:

I would like to get the test or test/slash annotations inside my logs but I can't find out how to do it.
The "- add_kubernetes_metadata:" part works as this gives me a uui, name etc as extra fields.
I did already try

    - add_kubernetes_metadata:
        in_cluster: false
        include_annotations: ['*'] also ['test','test/slash']
        host: "{{ ansible_fqdn }}"

Any help in pointing me into the right direction would be much appreciated.

PS This is a self hosted stack.

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.