I am trying to make filebeat work with the official elastic helm chart.
I would like to parse only the pods that have the "logging" : "json_log" annotation. As soon as i deploy pods that have that annotation for some reason i am getting all the events parsed , like the logs from filebeats. What exactly i am configuring wrong?
filebeat.autodiscover:
providers:
- type: kubernetes
in_cluster: true
tags:
- "kubernetes"
templates:
- condition:
contains:
kubernetes.annotations.logging: "json_log"
config:
- type: container
json.keys_under_root: true
json.add_error_key: true
json.message_key: msg
paths:
- '/var/lib/docker/containers/*/*.log'
processors:
- add_kubernetes_metadata:
in_cluster: true
output.elasticsearch:
hosts: ["http://xxxxx:9200"]