About the Filebeat type: docker

Elastic Stack Beats
,
1

Hi, I have a question about filebeat.yml. I want to match the specified pod_name, but processors.add_kubernetes_metadata only match namespace.
this is my setting:

metadata:
name: filebeat-inputs
namespace: elk
data:
kubernetes.yml: |
- type: docker
combine_partial: true
fields:
log_topics: wiz-pre
containers:
path: "/var/lib/docker/containers"
stream: "all"
ids: "*"
multiline.pattern: '^\d{4}-'
multiline.negate: true
multiline.match: after
exclude_lines: ['Completed', 'Triggering']
tail_files: true
processors:
- add_kubernetes_metadata:
in_cluster: true
namespace: default

if I have a pod which name is testpod_xxxx (kind: Deployment), how can I only output this pod logs?

2

It sounds like you aren't trying to limit the scope of add_kubernetes_metadata so much as to only run it on a certain pod. That kind of change should probably go in your kubernetes config, e.g. using spec.selector to limit the daemonset configuration to a particular pod. namespace is to control which environment the add_kubernetes_metadata processor queries, but the processor has no control over which pod it's running on, which is why there isn't an analogous setting for pod.