Open
Description
Hi
Talking about these documentation pages:
- https://www.elastic.co/guide/en/beats/metricbeat/current/configuration-autodiscover.html#_kubernetes
- https://www.elastic.co/guide/en/beats/filebeat/current/configuration-autodiscover.html#_kubernetes
- https://www.elastic.co/guide/en/beats/heartbeat/current/configuration-autodiscover.html#_kubernetes
We are missing clear indications about when to use one syntax or an other when it comes to use Kubernetes fields.
Across the documentation page and various examples, we can see that:
- Generic Kubernetes fields
host
andport
are used with a${data.host}
and${data.port}
syntax. - Pod Specific fields (and Node/Service specific maybe?) can be used straight in conditionals:
kubernetes.container.name: "traefik"
- Generic Kubernetes fields
kubernetes.labels.*
andkubernetes.annotations.*
must be used with${kubernetes.labels.*}
and${kubernetes.annotations.*}
syntax. Otherwise Beats throw this error:filebeat-quickstart-kt66v filebeat {"log.level":"warn","@timestamp":"2023-05-26T15:17:41.390Z","log.logger":"conditions","log.origin":{"file.name":"conditions/equals.go","file.line":48},"message":"expected string but got type mapstr.M in equals condition.","service.name":"filebeat","ecs.version":"1.6.0"}
For clarity, I suggest we summarize on the documentation page which Kubernetes field require which syntax along with comprehensive examples
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment