# Kubernetes and ignore\_outgoing setting

**URL:** <https://discuss.elastic.co/t/kubernetes-and-ignore-outgoing-setting/126473>\
**Category:** Beats\
**Tags:** packetbeat\
**Created:** [April 2, 2018, 10:15pm UTC](https://discuss.elastic.co/t/kubernetes-and-ignore-outgoing-setting/126473 "2018-04-02T22:15:49Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![lusid](https://avatars.discourse-cdn.com/v4/letter/l/e56c9b/32.png) [@lusid](https://discuss.elastic.co/u/lusid)\
**Post date:** [April 2, 2018, 10:15pm UTC](https://discuss.elastic.co/t/kubernetes-and-ignore-outgoing-setting/126473/1 "2018-04-02T22:15:49Z")

</div>

I'm not sure if this is specific to the Kubernetes environment or not, but it seems I am unable to get ignore\_outgoing to work. I have heard that the server and client\_server fields are important for this purpose, but they are always blank in my experiences since we've switched to Kubernetes. The documentation isn't clear on what the requirements are for the ignore\_outgoing setting to work correctly, and it is important in my case as it would theoretically reduce the total size of our logs by at least 1/3. I've tried looking at the code on GitHub, but it still isn't clear to me what I would need to change.

Any information that can be provided at all would be most appreciated. Thanks.

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [April 3, 2018, 1:52pm UTC](https://discuss.elastic.co/t/kubernetes-and-ignore-outgoing-setting/126473/2 "2018-04-03T13:52:31Z")

</div>

I believe `ignore_outgoing` works based on this logic:

```auto
let local_ips := set of all local IP addresses assigned to interfaces
if `src` in local_ips {
    drop transaction
}

```

So perhaps it's an issue with the container's IP addresses vs the host's IP addresses?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 1, 2018, 2:00pm UTC](https://discuss.elastic.co/t/kubernetes-and-ignore-outgoing-setting/126473/3 "2018-05-01T14:00:25Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.