Clarify syntax for Kubernetes fields usage in beat Autodiscover documentation

[jeanfabrice]

Hi

Talking about these documentation pages:

• https://www.elastic.co/guide/en/beats/metricbeat/current/configuration-autodiscover.html#_kubernetes
• https://www.elastic.co/guide/en/beats/filebeat/current/configuration-autodiscover.html#_kubernetes
• https://www.elastic.co/guide/en/beats/heartbeat/current/configuration-autodiscover.html#_kubernetes

We are missing clear indications about when to use one syntax or an other when it comes to use Kubernetes fields.

Across the documentation page and various examples, we can see that:

• Generic Kubernetes fields host and port are used with a ${data.host} and ${data.port} syntax.
• Pod Specific fields (and Node/Service specific maybe?) can be used straight in conditionals: kubernetes.container.name: "traefik"
• Generic Kubernetes fields kubernetes.labels.* and kubernetes.annotations.* must be used with ${kubernetes.labels.*} and ${kubernetes.annotations.*} syntax. Otherwise Beats throw this error: filebeat-quickstart-kt66v filebeat {"log.level":"warn","@timestamp":"2023-05-26T15:17:41.390Z","log.logger":"conditions","log.origin":{"file.name":"conditions/equals.go","file.line":48},"message":"expected string but got type mapstr.M in equals condition.","service.name":"filebeat","ecs.version":"1.6.0"}

For clarity, I suggest we summarize on the documentation page which Kubernetes field require which syntax along with comprehensive examples

[elasticmachine]

Pinging @elastic/ingest-docs (Team:Docs)

[botelastic[bot]]

Hi! We just realized that we haven't looked into this issue in a while. We're sorry!

We're labeling this issue as Stale to make it hit our filters and make sure we get back to it as soon as possible. In the meantime, it'd be extremely helpful if you could take a look at it as well and confirm its relevance. A simple comment with a nice emoji will be enough :+1. Thank you for your contribution!

[ignacioli]

:+1

[Aohzan]

@jeanfabrice do you have an example of how to use kubernetes.labels.* field to avoid the issue ? thank you

[jeanfabrice]

@Aohzan, I'm unsure what issue we are talking about. Based on the initial message, I think ${kubernetes.labels.*} is the correct name to use in Beats conditionals for Kubernetes labels.

[Aohzan]

            - condition.and:
                - equals.kubernetes.namespace: foo
                - equals.kubernetes.labels.app: bar
              config:
                  …

didn't work once upgraded from 7.x to 8.16, I got the error message you mention. So I tried stuff like equals.${kubernetes.labels.app}: bar. But it turned out that just app label doens't work for some reason I don't know, but

            - condition.and:
                - equals.kubernetes.namespace: foo
                - equals.kubernetes.labels.app.kubernetes.io/instance: bar
              config:
                  …

works well… I didn't have the error in logs anymore too 🤷