Drop event in heartbeat

I would like drop event when namespace is different of "production"
I'm using auto discover kubernetes into my heartbeat.yml

heartbeat.autodiscover:
 # Autodiscover services
 providers:
   - type: kubernetes
     resource: service
     scope: cluster
     node: ${NODE_NAME}
     hints.enabled: true
     processors:
      - drop_event.when:
          not.equals:
            kubernetes.namespace: "production"


kubernetes:
  namespace: production

output.elasticsearch:
  hosts: ['${ELASTICSEARCH_HOST:elasticsearch}:${ELASTICSEARCH_PORT:9200}']
  username: ${ELASTICSEARCH_USERNAME}
  password: ${ELASTICSEARCH_PASSWORD}

Into my service yaml added the elastic annotations:

annotations:
    co.elastic.monitor/type: http
    co.elastic.monitor/hosts: my-app.staging.svc.cluster.local:80/v1/status
    co.elastic.monitor/name: "my-app"
    co.elastic.monitor/schedule: "@every 1m"

I'm trying to use drop_event processors, for drop event when kubernetes.namespace is different of production, but this doesnt work

heartbeat.autodiscover:
 # Autodiscover services
 providers:
   - type: kubernetes
     resource: service
     scope: cluster
     node: ${NODE_NAME}
     hints.enabled: true
     processors:
      - drop_event.when:
          not.equals:
            kubernetes.namespace: "production"

Did you try to put processors on the root level?

like

processors:
  - drop_event.when:
      not.equals:
        kubernetes.namespace: "production"
heartbeat.autodiscover:
 # Autodiscover services
 providers:
   - type: kubernetes
     resource: service
     scope: cluster
     node: ${NODE_NAME}
     hints.enabled: true

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.