Getting K8s annotations in Filebeat logs

Hi,

I'm trying to get additional annotations from my K8s deployment into Elasticsearch.
I'm currently on filebeat 7.18.8.
My filebeat imputs in the filebeat.yml file look like the code below

filebeat.inputs:
- type: log
  enabled: true
  exclude_lines:
    # RI-813 OMSAgent is too noisy:
    - '^[A-Z][a-z][a-z] [0-9][0-9] [0-2][0-9]:[0-5][0-9]:[0-5][0-9] [a-zA-Z0-9]* sudo: omsagent : TTY=unknown'
  paths:
  {% for path in filebeat_paths %}
  - {{ path }}
  {% endfor -%}
  exclude_files:
  {% for exclusion in filebeat_exclude_files %}
  - "{{ exclusion }}"
  {% endfor %}
- type: docker
  containers.ids:
  {% if filebeat_kubelet_container_id is defined %}
  - {{ filebeat_kubelet_container_id }}
  {% else %}
  - '*'
  {% endif %}

  # containers.ids: '*'
  containers.path: "{{ filebeat_docker_root_dir }}/containers"
  processors:
    - add_docker_metadata:
        match_source_index: {{ filebeat_match_source_index }}
    - add_kubernetes_metadata:
        in_cluster: false
        host: "{{ ansible_fqdn }}"

my deployment.yml is similar to

apiVersion: apps/v1
kind: Deployment
metadata:
  annotations:
    test: abc
    test/slash: def
  name: somethingforjoey
spec:
  replicas: 1
  selector:
    matchLabels:
      app: somethingforjoey
  template:
    metadata:
      labels:
        app: somethingforjoey
    spec:
      containers:
      - env:

I would like to get the test or test/slash annotations inside my logs but I can't find out how to do it.
The "- add_kubernetes_metadata:" part works as this gives me a uui, name etc as extra fields.
I did already try

    - add_kubernetes_metadata:
        in_cluster: false
        include_annotations: ['*'] also ['test','test/slash']
        host: "{{ ansible_fqdn }}"

Any help in pointing me into the right direction would be much appreciated.

PS This is a self hosted stack.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.