Skip to content

Clarify syntax for Kubernetes fields usage in beat Autodiscover documentation #35602

Open

Description

Hi

Talking about these documentation pages:

We are missing clear indications about when to use one syntax or an other when it comes to use Kubernetes fields.

Across the documentation page and various examples, we can see that:

  • Generic Kubernetes fields host and port are used with a ${data.host} and ${data.port} syntax.
  • Pod Specific fields (and Node/Service specific maybe?) can be used straight in conditionals: kubernetes.container.name: "traefik"
  • Generic Kubernetes fields kubernetes.labels.* and kubernetes.annotations.* must be used with ${kubernetes.labels.*} and ${kubernetes.annotations.*} syntax. Otherwise Beats throw this error: filebeat-quickstart-kt66v filebeat {"log.level":"warn","@timestamp":"2023-05-26T15:17:41.390Z","log.logger":"conditions","log.origin":{"file.name":"conditions/equals.go","file.line":48},"message":"expected string but got type mapstr.M in equals condition.","service.name":"filebeat","ecs.version":"1.6.0"}

For clarity, I suggest we summarize on the documentation page which Kubernetes field require which syntax along with comprehensive examples

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions