Description
Describe the enhancement:
Have the Kubernetes provider look up metadata based on file path, similar to what the add_kubernetes_metadata
provider in Beats is capable of doing.
Describe a specific use case for the enhancement or feature:
From @henrikno:
We have this bug where we lose logs from short lived containers (e.g. if they're crashing). It seems to be like it happens when there's some delay in autodiscover, i.e. by the time it has discovered the container via k8s, and updated the policy to filebeat, the file has been rotated to the new "attempt", which has a new container id.
So I was looking if it's possible to "reverse" it, and look for the files, and look up metadata based on the file path. And that looks like whatadd_kubernetes_metadata
is doing.