If you are using the kubernetes module is there any reason to use the add_kubernetes_metadata processor? What is the difference between these two (module vs processor) and the use cases for each.
Thanks
Hey @akrzos,
In general is not needed to use add_kubernetes_metadata when generating configuration using autodiscover, or when using the kubernetes module. Autodiscover and the kubernetes module include their own Kubernetes metadata.
add_kubernetes_metadata is useful to enrich events collected by static configurations, some examples:
- Enrich events from filebeat collecting kubernetes logs with an static
containerinput: https://github.com/elastic/beats/blob/v7.8.0/deploy/kubernetes/filebeat-kubernetes.yaml#L16 - Enrich Auditbeat events from processes running inside kubernetes containers: https://github.com/elastic/beats/blob/v7.8.0/deploy/kubernetes/auditbeat-kubernetes.yaml#L37
- In Metricbeat it could be also used to enrich events from the system process metricset.
Thanks!
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.