About the Filebeat type: docker

Hi, I have a question about filebeat.yml. I want to match the specified pod_name, but processors.add_kubernetes_metadata only match namespace.
this is my setting:

metadata:
name: filebeat-inputs
namespace: elk
data:
kubernetes.yml: |
- type: docker
combine_partial: true
fields:
log_topics: wiz-pre
containers:
path: "/var/lib/docker/containers"
stream: "all"
ids: "*"
multiline.pattern: '^\d{4}-'
multiline.negate: true
multiline.match: after
exclude_lines: ['Completed', 'Triggering']
tail_files: true
processors:
- add_kubernetes_metadata:
in_cluster: true
namespace: default

if I have a pod which name is testpod_xxxx (kind: Deployment), how can I only output this pod logs?

It sounds like you aren't trying to limit the scope of add_kubernetes_metadata so much as to only run it on a certain pod. That kind of change should probably go in your kubernetes config, e.g. using spec.selector to limit the daemonset configuration to a particular pod. namespace is to control which environment the add_kubernetes_metadata processor queries, but the processor has no control over which pod it's running on, which is why there isn't an analogous setting for pod.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.