# Can anyone guide me to correct autodiscover condition?

**URL:** <https://discuss.elastic.co/t/can-anyone-guide-me-to-correct-autodiscover-condition/310359>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [July 22, 2022, 2:45am UTC](https://discuss.elastic.co/t/can-anyone-guide-me-to-correct-autodiscover-condition/310359 "2022-07-22T02:45:17Z")\
**Posts on this page:** 10\
**Page:** 1

<div class="post-metadata">

**Author:** ![wajika](https://avatars.discourse-cdn.com/v4/letter/w/977dab/32.png) [@wajika](https://discuss.elastic.co/u/wajika)\
**Post date:** [July 22, 2022, 2:45am UTC](https://discuss.elastic.co/t/can-anyone-guide-me-to-correct-autodiscover-condition/310359/1 "2022-07-22T02:45:17Z")

</div>

FB: 7.16.3

I try "- and:" and "and:" both get "missing or invalid condition".

```auto
filebeat.autodiscover.providers:
  - type: kubernetes
    node: ${NODE_NAME}
    templates:
      - condition:
           and: 
              - not:
                  kubernetes.container.name: "fluentd"
              - equals:
                  kubernetes.namespace: "kube-system"
        config:
          - module: nginx
            access:
              input:
                type: container
                stream: stdout
                paths:
                  - /var/log/containers/*${data.kubernetes.container.id}.log
            error:
              input:
                type: container
                stream: stderr
                paths:
                  - /var/log/containers/*${data.kubernetes.container.id}.log

```

update:  
I found my mistake, there is no comparison condition under "not".

```auto
filebeat.autodiscover.providers:
  - type: kubernetes
    node: ${NODE_NAME}
    templates:
    - condition:
        and:
        - equals.kubernetes.namespace: "kube-system"
        - not.equals.kubernetes.container.name: "fluentd"

```

update:  
In addition, I also found that under a logical operation, there can only be one comparison condition, for example, the following "and" can only use one "equals".

I'm not sure if my understanding is correct, but I test the following statement cannot run filebeat.  
Statements are just for testing, do not make any evaluation of significance.

```auto
filebeat.autodiscover.providers:
  - type: kubernetes
    node: ${NODE_NAME}
    templates:
      - condition:
          and:
          - equals:
              kubernetes.namespace: "kube-system"
          - equals:
              kubernetes.namespace: "elastic"
          - not:
              - equals:
                  kubernetes.container.name: "fluentd"

filebeat.autodiscover.providers:
  - type: kubernetes
    node: ${NODE_NAME}
    templates:
      - condition:
          and:
          - or:
              - equals:
                  kubernetes.namespace: "kube-system"
              - equals:
                  kubernetes.namespace: "elastic"
         - not:
              - equals:
                  kubernetes.container.name: "fluentd"

```

---

<div class="post-metadata">

**Author:** ![wajika](https://avatars.discourse-cdn.com/v4/letter/w/977dab/32.png) [@wajika](https://discuss.elastic.co/u/wajika)\
**Post date:** [July 25, 2022, 3:46am UTC](https://discuss.elastic.co/t/can-anyone-guide-me-to-correct-autodiscover-condition/310359/2 "2022-07-25T03:46:53Z")

</div>

The same problem occurs on output.kafka, the log says the given type is incorrect.

`WARN	[conditions]	conditions/equals.go:48	expected string but got type []string in equals condition.`

```auto
output.kafka:
   enabled: true
   hosts: ["1.1.1.1:9092"]
   topics:
   - topic: "logs_backend_dev"
       when:
         and:
         - equals:
             type: "backend"
         - equals:
             environment: "dev"
   parttion.round_robin:
      reacheble_only: false
   required_acks: 1
   commpression: gzip
   max_message_bytes: 1000000

```

@jsoriano Hello, I found that you have answered similar questions on github, can you help me answer this question again?

---

<div class="post-metadata">

**Author:** ![jsoriano](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jsoriano/32/27920_2.png) [@jsoriano](https://discuss.elastic.co/u/jsoriano)\
**Post date:** [July 25, 2022, 7:17pm UTC](https://discuss.elastic.co/t/can-anyone-guide-me-to-correct-autodiscover-condition/310359/3 "2022-07-25T19:17:49Z")

</div>

@wajika I see you made several updates of the original topic. Did you find a working configuration? what is the whole configuration you have now?

---

<div class="post-metadata">

**Author:** ![wajika](https://avatars.discourse-cdn.com/v4/letter/w/977dab/32.png) [@wajika](https://discuss.elastic.co/u/wajika)\
**Post date:** [July 26, 2022, 1:00am UTC](https://discuss.elastic.co/t/can-anyone-guide-me-to-correct-autodiscover-condition/310359/4 "2022-07-26T01:00:40Z")

</div>

I marked the update: section in the first post, everything after that is new questions, and my problem has been unsolved because I couldn't find any correct multi-conditional syntax to test successfully.

I only use one condition now and it is running successfully, but I want to know how to write the correct multi-condition syntax. I have sorted out some syntax formats according to the results of the forum search, but there will be corresponding problems when using it on filebeat 7.16.3.

For example this prompt `expected string but got type []string in equals condition.` I also made a lot of changes but I did not keep records.

---

<div class="post-metadata">

**Author:** ![jsoriano](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jsoriano/32/27920_2.png) [@jsoriano](https://discuss.elastic.co/u/jsoriano)\
**Post date:** [July 26, 2022, 10:26am UTC](https://discuss.elastic.co/t/can-anyone-guide-me-to-correct-autodiscover-condition/310359/5 "2022-07-26T10:26:37Z")

</div>

The `not` condition doesn't expect a list, but a single element [Define processors | Filebeat Reference [8.3] | Elastic](https://www.elastic.co/guide/en/beats/filebeat/current/defining-processors.html#condition-not)

Try this:

```auto
      - condition:
          and:
            - or:
              - equals:
                  kubernetes.namespace: "kube-system"
              - equals:
                  kubernetes.namespace: "elastic"
            - not:
                equals:
                  kubernetes.container.name: "fluentd"

```

---

<div class="post-metadata">

**Author:** ![wajika](https://avatars.discourse-cdn.com/v4/letter/w/977dab/32.png) [@wajika](https://discuss.elastic.co/u/wajika)\
**Post date:** [July 27, 2022, 12:20am UTC](https://discuss.elastic.co/t/can-anyone-guide-me-to-correct-autodiscover-condition/310359/6 "2022-07-27T00:20:54Z")

</div>

Thanks, then there's nothing wrong with the not condition.  
Another question, why does the following when.or not take effect? I didn't find the topic name "logs-hz" in kafka.

```auto
name: xxxx
tags: ["pre","dev","test"]
fields:
  env: development

filebeat.autodiscover:
  providers:
    - type: kubernetes
      node: ${NODE_NAME}
      hints.enabled: true
      hints.default_config.enabled: false

processors:
- add_kubernetes_metadata:
    default_indexers.enabled: false
    default_matchers.enabled: false

logging.level: info

output.kafka:
   enabled: true
   hosts: ["1.0.1.0:9092"]
   topics:
   - topic: "logs-hz"
     when.or:
       - contains:
           kubernetes.kubernetes.namespace: "ac-test"
       - contains:
           kubernetes.kubernetes.namespace: "iot-test"
   - topic: "nginx"
     when:
       contains:
         kubernetes.labels.app: "ingress-nginx"
   parttion.round_robin:
      reacheble_only: false
   required_acks: 1
   commpression: gzip
   max_message_bytes: 1000000

output.elasticsearch:
  enabled: false
  hosts: ['${ELASTICSEARCH_HOST:elasticsearch}:${ELASTICSEARCH_PORT:9200}']
  username: ${ELASTICSEARCH_USERNAME}
  password: ${ELASTICSEARCH_PASSWORD}

```

One more thing, is the syntax below correct?

```auto
   topics:
   - topic: "logs-hz"
     when.or:
       - equals:
           kubernetes.namespace: "ac-test"
       - equals:
           kubernetes.namespace: "masa-iot-test"
---
   topics:
   - topic: "logs_backend_dev"
       when:
         and:
         - equals:
             type: "backend"
         - equals:
             environment: "dev"

```

---

<div class="post-metadata">

**Author:** ![wajika](https://avatars.discourse-cdn.com/v4/letter/w/977dab/32.png) [@wajika](https://discuss.elastic.co/u/wajika)\
**Post date:** [July 27, 2022, 1:23am UTC](https://discuss.elastic.co/t/can-anyone-guide-me-to-correct-autodiscover-condition/310359/7 "2022-07-27T01:23:38Z")

</div>

Can you revise the document to add detailed instructions?

---

<div class="post-metadata">

**Author:** ![jsoriano](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jsoriano/32/27920_2.png) [@jsoriano](https://discuss.elastic.co/u/jsoriano)\
**Post date:** [July 27, 2022, 9:38am UTC](https://discuss.elastic.co/t/can-anyone-guide-me-to-correct-autodiscover-condition/310359/8 "2022-07-27T09:38:12Z")

</div>

> [@wajika](#):
>
> Another question, why does the following when.or not take effect? I didn't find the topic name "logs-hz" in kafka.

The condition looks good, but does the event really contain the field `kubernetes.kubernetes.namespace`? I would say that this field should be `kubernetes.namespace`.

> [@wajika](#):
>
> One more thing, is the syntax below correct?

This syntax looks mostly correct, but I think that in the second snippet, `when` should be at the same indentation level as `topic`, like this:

```auto
   topics:
   - topic: "logs_backend_dev"
     when:
       and:
         ...

```

---

<div class="post-metadata">

**Author:** ![wajika](https://avatars.discourse-cdn.com/v4/letter/w/977dab/32.png) [@wajika](https://discuss.elastic.co/u/wajika)\
**Post date:** [July 28, 2022, 1:07am UTC](https://discuss.elastic.co/t/can-anyone-guide-me-to-correct-autodiscover-condition/310359/9 "2022-07-28T01:07:00Z")

</div>

ok, i made some low-level mistakes, thanks for the correction.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 25, 2022, 3:07am UTC](https://discuss.elastic.co/t/can-anyone-guide-me-to-correct-autodiscover-condition/310359/10 "2022-08-25T03:07:49Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.