How fix add_kubernetes_metadata in new version 7.7.0?

[davidoceans]

Hi,

I've update to latest version of filebeat because I would like test the nginx-ingress-controller parser.
docker.elastic.co/beats/filebeat:7.7.0

But I was using this add_kubernetes_metadata.

Sorry could you say me how I should to change it to work properly?

I'm using Kubernetes, and this is a section of my filebeat configmap

    filebeat.inputs:
    - type: container
      paths:
        - /var/log/containers/*.log
      multiline.pattern: '^[[:space:]]+(at|\.{3})\b|^Caused by:'
      multiline.negate: false
      multiline.match: after
      processors:
        - add_kubernetes_metadata:
            in_cluster: true
            host: ${NODE_NAME}
            matchers:
            - logs_path:
                logs_path: "/var/log/containers/"

Thank you very much

[jsoriano]

I am reopening this issue because after some internal discussion we consider that this may be considered a regression, caused by #16979. There is a change there that makes the processor ignore indexers and matchers defined in configuration if default_matchers.enabled is not set to false. This could be considered its correct behaviour, but there was not reason to change it, as it has been working for long in a different way. I will revert to the old behaviour and add some testing to avoid unexpectedly changing it in the future.

[elasticmachine]

Pinging @elastic/integrations-platforms (Team:Platforms)

[jsoriano]

By the way, there is a workaround, that is to set default_matchers.enabled to false. It would be like this in the config snippet in the description:

        ...
        - add_kubernetes_metadata:
            in_cluster: true
            host: ${NODE_NAME}
            default_matchers.enabled: false
            matchers:
            - logs_path:
                logs_path: "/var/log/containers/"