# Collect Kubernetes audit logs from local files only if node label exists via fleet

**URL:** https://discuss.elastic.co/t/collect-kubernetes-audit-logs-from-local-files-only-if-node-label-exists-via-fleet/386344
**Category:** Elastic Agent
**Tags:** fleet
**Created:** [May 14, 2026, 6:10pm UTC](https://discuss.elastic.co/t/collect-kubernetes-audit-logs-from-local-files-only-if-node-label-exists-via-fleet/386344 "2026-05-14T18:10:16Z")
**Posts on this page:** 1
**Page:** 1

<div class="post-metadata">

### Author: ![AndrewDatTeranet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewdatteranet/32/86108_2.png) [@AndrewDatTeranet](https://discuss.elastic.co/u/AndrewDatTeranet)
#### Post date: [May 14, 2026, 6:10pm UTC](https://discuss.elastic.co/t/collect-kubernetes-audit-logs-from-local-files-only-if-node-label-exists-via-fleet/386344/1 "2026-05-14T18:10:16Z")

</div>

While trying to set up the "Collect Kubernetes audit logs from local files" with the Kubernetes integration in fleet, I was trying to add a condition to only collect logs if the node label kubernetes.labels.node-role\_kubernetes\_io\_control-plane existed on the node. is this possible?  
if not this is there a way to add a condition that checks for if a directory exists before attempting to read (condition not processor basically)  
Tried `${ne(kubernetes.labels.node-role_kubernetes_io_control-plane, null)}` and many other iterations without luck and the conditions linked at [Variables and conditions in input configurations | Elastic Docs](https://www.elastic.co/docs/reference/fleet/dynamic-input-configuration#conditions) don't really apply.