Kubernetes and ignore_outgoing setting

Elastic Stack Beats
1

I'm not sure if this is specific to the Kubernetes environment or not, but it seems I am unable to get ignore_outgoing to work. I have heard that the server and client_server fields are important for this purpose, but they are always blank in my experiences since we've switched to Kubernetes. The documentation isn't clear on what the requirements are for the ignore_outgoing setting to work correctly, and it is important in my case as it would theoretically reduce the total size of our logs by at least 1/3. I've tried looking at the code on GitHub, but it still isn't clear to me what I would need to change.

Any information that can be provided at all would be most appreciated. Thanks.

2

I believe ignore_outgoing works based on this logic:

let local_ips := set of all local IP addresses assigned to interfaces
if `src` in local_ips {
    drop transaction
}

So perhaps it's an issue with the container's IP addresses vs the host's IP addresses?

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.