Dropping Events in Kubernetes

Elastic Stack Beats
1

Hi all,

i am having a hard time getting filebeat to filter events from kubernetes.
I have the processor (beat 6.2.3) setup like this:

    - type: docker
      containers.ids:
      - "*"
      processors:
        - add_kubernetes_metadata:
            in_cluster: true

        - drop_event:
            when:
              or:
                - equals:
                    kubernetes.container.name: 'prometheus-node-exporter'
                - equals:
                    kubernetes.container.name: 'prometheus-kube-state-metrics'
                - equals:
                    kubernetes.container.name: 'filebeat'
                - equals:
                    kubernetes.container.name: 'heapster'

But the logs still show up in kibana/elasticsearch.. Does anyone have a clue what i am doing wrong?

regards,
roman

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.