Hi, I'm trying to populate a field kubernetes.deployment.name
.
I'm getting only the higher level kubernetes.replicaset.name
. There isn't any error in the log.
My config:
filebeat:
enabled: true
filebeatConfig:
filebeat.yml: |-
logging.level: warning
filebeat.inputs:
- type: container
paths:
- /var/log/containers/*.log
processors:
- add_kubernetes_metadata:
host: ${NODE_NAME}
matchers:
- logs_path:
logs_path: "/var/log/containers/"
output.logstash:
hosts: ["loki-logstash-headless:5044"]
logstash:
enabled: true
image: REDACTED
imageTag: latest
imagePullPolicy: "Always"
logstashConfig:
logstash.yml: |
http.host: 0.0.0.0
xpack.monitoring.enabled: false
# deployment_name doesn't work
logstashPipeline:
logstash.conf: |
input {
beats {
port => 5044
}
}
filter {
if [kubernetes] {
mutate {
add_field => {
pod_name => "%{[kubernetes][pod][name]}"
container_name => "%{[kubernetes][container][name]}"
statefulset_name => "%{[kubernetes][statefulset][name]}"
deployment_name => "%{[kubernetes][deployment][name]}"
replicaset_name => "%{[kubernetes][replicaset][name]}"
container_image => "%{[kubernetes][container][image]}"
namespace => "%{[kubernetes][namespace]}"
}
replace => { "host" => "%{[kubernetes][node][name]}"}
}
}
mutate {
remove_field => [tags]
}
if [replicaset_name] =~ /^%{.*}/ {
mutate {
remove_field => [replicaset_name]
}
}
if [statefulset_name] =~ /^%{.*}/ {
mutate {
remove_field => [statefulset_name]
}
}
output {
loki {
url => REDACTED
}
}
It just sets deployment_name to %{[kubernetes][deployment][name]}