{"action":"created","issue":{"url":"https://api.github.com/repos/elastic/packetbeat/issues/133","labels_url":"https://api.github.com/repos/elastic/packetbeat/issues/133/labels{/name}","comments_url":"https://api.github.com/repos/elastic/packetbeat/issues/133/comments","events_url":"https://api.github.com/repos/elastic/packetbeat/issues/133/events","html_url":"https://github.com/elastic/packetbeat/issues/133","id":81502072,"number":133,"title":"Running PacketBeat Agent on each Kubernetes Pod","user":{"login":"mingfang","id":821695,"avatar_url":"https://avatars.githubusercontent.com/u/821695?v=3","gravatar_id":"","url":"https://api.github.com/users/mingfang","html_url":"https://github.com/mingfang","followers_url":"https://api.github.com/users/mingfang/followers","following_url":"https://api.github.com/users/mingfang/following{/other_user}","gists_url":"https://api.github.com/users/mingfang/gists{/gist_id}","starred_url":"https://api.github.com/users/mingfang/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mingfang/subscriptions","organizations_url":"https://api.github.com/users/mingfang/orgs","repos_url":"https://api.github.com/users/mingfang/repos","events_url":"https://api.github.com/users/mingfang/events{/privacy}","received_events_url":"https://api.github.com/users/mingfang/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/elastic/packetbeat/labels/question","name":"question","color":"cc317c"}],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-05-27T15:41:33Z","updated_at":"2015-06-02T16:26:17Z","closed_at":"2015-06-02T16:26:17Z","body":"I'm currently running the PacketBeat Agent each host that is also a Kubernetes Node using --net=host.\r\nHere is my Agent https://github.com/mingfang/docker-packetbeat-agent\r\n\r\nThis works but I loose the ability to identify the flow for each Pod; Every Rest call on each host comes from the same Agent.  \r\nTo fix it I was thinking about running an Agent on each Pod.\r\nQuestion is, is this inefficient?\r\nI can imagine this will require more memory since I'll be running multiple Agents, but they should use the same CPU since all in all they are decoding the same number of packets.\r\n\r\nIt would be great if there is a way to run one Agent at the host level and still be able to somehow identify each packet from each Docker container. hint hint."},"comment":{"url":"https://api.github.com/repos/elastic/packetbeat/issues/comments/108006318","html_url":"https://github.com/elastic/packetbeat/issues/133#issuecomment-108006318","issue_url":"https://api.github.com/repos/elastic/packetbeat/issues/133","id":108006318,"user":{"login":"tsg","id":101817,"avatar_url":"https://avatars.githubusercontent.com/u/101817?v=3","gravatar_id":"","url":"https://api.github.com/users/tsg","html_url":"https://github.com/tsg","followers_url":"https://api.github.com/users/tsg/followers","following_url":"https://api.github.com/users/tsg/following{/other_user}","gists_url":"https://api.github.com/users/tsg/gists{/gist_id}","starred_url":"https://api.github.com/users/tsg/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tsg/subscriptions","organizations_url":"https://api.github.com/users/tsg/orgs","repos_url":"https://api.github.com/users/tsg/repos","events_url":"https://api.github.com/users/tsg/events{/privacy}","received_events_url":"https://api.github.com/users/tsg/received_events","type":"User","site_admin":false},"created_at":"2015-06-02T16:26:17Z","updated_at":"2015-06-02T16:26:17Z","body":"Sorry for the late answer. There is some overhead in memory, but CPU wise I think there shouldn't be too much of a difference, unless the agents see some of the traffic twice. Closing the issue as from now on we prefer questions on the new [forums](https://discuss.elastic.co/c/beats/packetbeat)."}}