EFK Stack on Kubernetes - Collecting logs from default namespace

Hi, I am using EFK stack on Kubernetes, I want to configure fluentd to collect logs from one specific namespace, the default namespace.
This is my fleuntd config file:

<label @FLUENT_LOG>
      <match fluent.**>
        @type null

      @type tail
      path /var/log/containers/*.log
      pos_file /var/log/app.log.pos
      tag kubernetes.*
      read_from_head true
        @type json
        time_format %Y-%m-%dT%H:%M:%S.%NZ

    <filter kubernetes.**>
        @type kubernetes_metadata

    <filter kubernetes.**>
       @type grep
            key log
            pattern (.\[notice]\.*|^[ \\\/\(\)\*\|_]+(?!.*[a-zA-Z0-9]).*$|^\s*$|.*GET*|.*POST*)
            key kubernetes.namespace_name
            pattern /^default$/
    <match ** >
       @type elasticsearch_dynamic
       @log_level info
       include_tag_key true
       scheme "#{ENV['FLUENT_ELASTICSEARCH_SCHEME'] || 'http'}"
       ssl_verify "#{ENV['FLUENT_ELASTICSEARCH_SSL_VERIFY'] || 'true'}"
       reload_connections true
       logstash_format true
       logstash_prefix logstash
           @type file
           path /var/log/fluentd-buffers/kubernetes.system.buffer
           flush_mode interval
           retry_type exponential_backoff
           flush_thread_count 2
           flush_interval 5s
           retry_forever true
           retry_max_interval 30
           chunk_limit_size 2M
           queue_limit_length 32
           overflow_action block

The way I tired to do that is by adding:

            key kubernetes.namespace_name
            pattern /^default$/

but is not working this way, fluentd is not collecting any logs.

I don't know if the question is for here but please help me if you know the answer.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.