Running metricbeat 8.13 with ECK, against Kubernetes AKS 1.28
The config is simple, I want only metrics about containers in a single namespace:
autodiscover:
providers:
- hints:
enabled: true
default_config:
enabled: false
node: ${NODE_NAME}
type: kubernetes
templates:
- condition:
contains:
kubernetes.namespace: platform-mon-elastic-agents
config:
- module: kubernetes
period: 30s
node: ${NODE_NAME}
hosts:
- https://${NODE_NAME}:10250
bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token
ssl.certificate_authorities:
- /etc/kubernetes/certs/kubeletserver.crt
metricsets:
- container
add_metadata: true
modules:
- module: system
period: 10s
metricsets:
- cpu
- load
- memory
- network
- process
I am expected to see 12 documents per minute, but I see ALL cluster containers. ES documents are wrong:
Here this is mix, container image and container name are not good. I see "kubernetes.deployment: patient" which is in another namespace, but also "kubernetes.daemonset" field in same time:
{
"_index": ".ds-metricbeat-8.13.2-dev-caputova-2024.04.28-000001",
"_id": "zBAAKo8B02pENtCMYR0l",
"_version": 1,
"_score": 0,
"_source": {
"@timestamp": "2024-04-29T13:16:52.348Z",
"event": {
"module": "kubernetes",
"duration": 4165943,
"dataset": "kubernetes.container"
},
"kubernetes": {
"pod": {
"uid": "3e80c9bb-8d12-4b07-b121-710135d4a4d2",
"ip": "10.100.1.4",
"name": "test-filebeat-beat-filebeat-j6nzc"
},
"deployment": {
"name": "patient"
},
"container": {
"name": "elastic-internal-init-keystore"
},
"namespace": "platform-mon-elastic-agents",
"daemonset": {
"name": "test-filebeat-beat-filebeat"
}
},
"container": {
"image": {
"name": "docker.elastic.co/beats/filebeat:8.10.4"
},
"name": "petal-patient",
"id": "2b59701f82be36291756e153931b4744393fcaf7154d974ef5125441ea6b0785",
"runtime": "containerd"
},
"ecs": {
"version": "8.0.0"
},
"host": {
"name": "aks-default-XXXXX-vmss000001"
},
"metricset": {
"name": "container",
"period": 30000
},
"service": {
"address": "https://aks-default-XXXX-vmss000001:10250/stats/summary",
"type": "kubernetes"
}
}
}