Create index for kube-system and rest of the namespaces another index

Hi Team, we are trying to create a new index for Kube-system namespace related logs as one index and rest of the system as another index.
as part of that we have below spec read and deployed but we are not seeing any indexes getting created for kubesystem.
Can someone please guide us.

This is what we have written to achieve it.

output {
if [kubernetes][namespace] == "kube-system" {
Elasticsearch {
hosts => [""]
index => "test-%{[kubernetes][namespace]}-%{+YYYY.MM.dd}"
} else {
Elasticsearch {
hosts => ["""]
index => "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.