I have a filebeat outside of the kubernetes cluster, installed as an application on the host. I want to ignore two namespaces in filebeat, since they are very large and I don't need them within elastichsearch.
Here is my input definition in filebeat.yml:
- type: log
enabled: true
paths:
- /var/lib/docker/containers/*/*.log
json.message_key: log
json.keys_under_root: true
processors:
- add_kubernetes_metadata:
in_cluster: false
host: main-backend
kube_config: /etc/kubernetes/admin.conf
- drop_event.when.regexp:
or:
- kubernetes.namespace: "kube-system"
- kubernetes.namespace: "monitoring"However, I still see a lot of log from those namespaces within my elasticsearch. Is there any way to debug it why is it happening?
Can you try as given below
- drop_event:
when:
or:
- not:
equals:
kubernetes.namespace: "kube-system"
- not:
equals:
kubernetes.namespace: "monitoring"
- regexp:
kubernetes.pod.name: "filebeat-*"
- regexp:
kubernetes.pod.name: "elasticsearch-*"