Hi, I have a question about filebeat.yml. I want to match the specified pod_name, but processors.add_kubernetes_metadata only match namespace.
this is my setting:
metadata:
name: filebeat-inputs
namespace: elk
data:
kubernetes.yml: |
- type: docker
combine_partial: true
fields:
log_topics: wiz-pre
containers:
path: "/var/lib/docker/containers"
stream: "all"
ids: "*"
multiline.pattern: '^\d{4}-'
multiline.negate: true
multiline.match: after
exclude_lines: ['Completed', 'Triggering']
tail_files: true
processors:
- add_kubernetes_metadata:
in_cluster: true
namespace: default
if I have a pod which name is testpod_xxxx (kind: Deployment), how can I only output this pod logs?