Change elastic's index name to a kubernetes pod label

Elastic Stack Beats
1

Hi guys.

I am migrating from fluentbit to filebeat to ship logs from kubernetes to graylog 4.

The idea is to create 'graylog-application_name' indexes to let me know identify properly which data holds each index.
As far as I read in the doc, it is possible to change the elastic's index name.
The example in the doc (here) mentions "customname-%{[agent.version]}" but I want to use the value of the label app.kubernetes.io/instance.

I mean, the pod has:

  label:
     app.kubernetes.io/instance: my_app_name

and I want the logs of that pod be indexed in an index named 'graylog-my_app_name'

I have been trying to find an example on how to use the kubernetes metadata as variables in the config (and wondering if I have to dedot the label app.kubernetes.io/instance, including the / character).
Unfortunatelly I was not able to find any example or documentation in the last two days.

Anyone knows how to access to the kubernetes metadata to use it in the config and how to proceed to set the index name using the label name?

Any insight is welcome
Thanks in advance

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.