asp
August 20, 2019, 6:38am
3
@pmercado thanks for your reply.
I am using following workaround now:
ship all metricbeat probes to logstash and copy all fields below _module to kubernetes root.
Details can be found here. It is not as generic as it should, but it is the fastest workaround which works for me.
mutate+copy is a no-op if a field does not exist, so you can compress this down to
mutate {
copy => {
"[kubernetes][container][_module][labels]" => "[kubernetes][labels]"
"[kubernetes][container][_module][namespace]" => "[kubernetes][namespace]"
"[kubernetes][container][_module][node]" => "[kubernetes][node]"
"[kubernetes][container][_module][pod]" => "[kubernetes][pod]"
"[kubernetes][pod][_module][labels]" => "[kubern…