Please include configurations and logs if available.

For confirmed bugs, please report:

• Version: n/a
• Operating System: Linux
• Discuss Forum URL: n/a
• Steps to Reproduce:

The sample manifest for k8s provided in deploy/kubernetes/auditbeat-kubernetes.yaml uses the add_process_metadata and add_kubernetes_metadata to enrich events based on the process.pid field:

    processors:
      - add_cloud_metadata:
      - add_process_metadata:
          match_pids: ['process.pid']
          include_fields: ['container.id']
      - add_kubernetes_metadata:
          host: ${NODE_NAME}
          default_indexers.enabled: false
          default_matchers.enabled: false
          indexers:
            - container:
          matchers:
            - fields.lookup_fields: ['container.id']

The drawback of this approach is that it's sensitive to timing. If the process identified by process.pid has terminated by the time the add_process_metadata processor runs, the container.id lookup will fail and no k8s metadata will be added to the event.

This is causing some processes to not be to associated to a container at all, or the association to happen randomly.