# How do I avoid including kubernetes.labels?

**URL:** <https://discuss.elastic.co/t/how-do-i-avoid-including-kubernetes-labels/351874>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [January 26, 2024, 12:02pm UTC](https://discuss.elastic.co/t/how-do-i-avoid-including-kubernetes-labels/351874 "2024-01-26T12:02:14Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Ananym](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ananym/32/131140_2.png) [@Ananym](https://discuss.elastic.co/u/Ananym)\
**Post date:** [January 26, 2024, 12:02pm UTC](https://discuss.elastic.co/t/how-do-i-avoid-including-kubernetes-labels/351874/1 "2024-01-26T12:02:14Z")

</div>

kubernetes.labels represents a lot of clutter that isn't useful to me. [Add Kubernetes metadata | Filebeat Reference [8.12] | Elastic](https://www.elastic.co/guide/en/beats/filebeat/current/add-kubernetes-metadata.html) explains how to drop labels from associated resources, but I can't work out how to avoid including labels themselves. Is drop\_fields with regex the only way?

---

<div class="post-metadata">

**Author:** ![Ananym](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ananym/32/131140_2.png) [@Ananym](https://discuss.elastic.co/u/Ananym)\
**Post date:** [January 26, 2024, 12:21pm UTC](https://discuss.elastic.co/t/how-do-i-avoid-including-kubernetes-labels/351874/2 "2024-01-26T12:21:42Z")

</div>

I can't get drop\_fields with regex to work, either. I was expecting /kubernetes\.labels\..\*/ and /agent\..\*/ to delete all subkeys under kubernetes.labels and agent, but it doesn't seem to. I don't know how drop\_fields interacts with hierarchical entries.

---

<div class="post-metadata">

**Author:** ![Andreas\_Gkizas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andreas_gkizas/32/117035_2.png) [@Andreas\_Gkizas](https://discuss.elastic.co/u/Andreas_Gkizas)\
**Post date:** [January 26, 2024, 12:50pm UTC](https://discuss.elastic.co/t/how-do-i-avoid-including-kubernetes-labels/351874/3 "2024-01-26T12:50:39Z")

</div>

Hello @Ananym ,

Can you try the following block

```auto
- add_resource_metadata:
          namespace:
            enabled: false
          node:
            enabled: false

```

The above will disable the metadata enrichment for node and namespace, so relevant kubernetes kubernetes.node.labels.\* and kubernetes.namespace\_labels.\*

Additionally if you use the kubernetes provider in filebeat autodiscovery like [here](https://github.com/elastic/beats/blob/main/deploy/kubernetes/filebeat-kubernetes.yaml#L134) you can use

```yaml
    providers:
       - type: kubernetes
         exclude_labels: .... 

```

Also the following processor should work I have tested it:

```auto
- drop_fields:
   fields:
      - kubernetes.labels

```

Let me know which of those helped you?

---

<div class="post-metadata">

**Author:** ![Ananym](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ananym/32/131140_2.png) [@Ananym](https://discuss.elastic.co/u/Ananym)\
**Post date:** [January 26, 2024, 1:16pm UTC](https://discuss.elastic.co/t/how-do-i-avoid-including-kubernetes-labels/351874/4 "2024-01-26T13:16:53Z")

</div>

to be clear, include\_labels: works for the node metadata, I was just hoping to see an equivalent for pod metadata.

I definitely have kubernetes.labels included as an entry in my drop\_fields processor but I'm still seeing them. (Some) Other fields in that array are being dropped appropriately. Drop fields is definitely positioned after add\_kubernetes\_metadata.

---

<div class="post-metadata">

**Author:** ![Andreas\_Gkizas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andreas_gkizas/32/117035_2.png) [@Andreas\_Gkizas](https://discuss.elastic.co/u/Andreas_Gkizas)\
**Post date:** [January 26, 2024, 1:44pm UTC](https://discuss.elastic.co/t/how-do-i-avoid-including-kubernetes-labels/351874/5 "2024-01-26T13:44:48Z")

</div>

> [@Andreas\_Gkizas](#):
>
> ```auto
> providers:
> - type: kubernetes
> exclude_labels: .... 
> 
> ```

Plese use `include_labels` also in the provider level. This will include only the pods labels specified

See the updated latest docs here : [Autodiscover | Filebeat Reference [master] | Elastic](https://www.elastic.co/guide/en/beats/filebeat/master/configuration-autodiscover.html)

"If the include\_labels config is added to the provider config, then the list of labels present in the config will be added to the event."

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 23, 2024, 3:45pm UTC](https://discuss.elastic.co/t/how-do-i-avoid-including-kubernetes-labels/351874/6 "2024-02-23T15:45:25Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.