We recently moved to Filebeat 7.x however, we no longer get kubernetes metadata added to our events.
We are using Filebeat 7.1.1 and Filebeat 7.2.0. This worked just fine in Filebeat 6.3.2. Also using Kubernetes 1.12
Here is the filebeat.yml for the filebeat pods, which are running as a daemonset on each host.
We get the logs just fine, as well as the Cloud Metadata, but nothing for Kubernetes Metadata.
filebeat.inputs: - type: docker containers.ids: - "*" containers.path: "/data/docker/containers" processors: - add_cloud_metadata: - add_kubernetes_metadata: in_cluster: true output.logstash: hosts: ["logstash.me.admin.us-east-2.private.8labs.io:6045"] ssl: enabled: true
We also tried using the
container input instead of the
docker input in 7.2.0 but had the same issue.