Elastic Agent configuration for creating new index based on kubernetes namespace

Elastic Stack Elastic Agent
1

Hi
In filebeat configuration, I could use the following config to create a separate index per kubernetes namespace.

    output.elasticsearch:
      indices:
        - index: '%{[kubernetes.namespace]}-%{[agent.version]}-%{+yyyy.MM.dd}'
          when:
            or:
            - equals.kubernetes.namespace: "namespace1"
            - equals.kubernetes.namespace: "namespace2"

How do I achieve the same result using ElasticAgent ? I am using version 7.17.5 of Kibana.

Appreciate your help.

2

Hi @umesh2020

Are you using standalone elastic-agent ? if yes - I think you should be able to define an output - similar as defined here, and then use_output setting

For fleet managed elastic-agent, I think you should be able to define another output with desired configuration and use this output for added integration (under Advanced options)

3

I am using fleet managed elastic-agent. Can you point me to some relevant links ?

4

Also, my namespaces are dynamically created, so is there a REST API that I can use to dynamically define these outputs ? In filebeat, I used to update the configuration using helm whenever a new environment is created.

5

You can check output setting and add desired configuration under Elasticsearch output configuration

I am not sure if in version 7.17 there was an option to create another output - seems it was added in 8.x, so adjusting the default output should be enough.

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.