Filebeat 8.2.1 kubernetes autodiscover template with multiple conditions doesn't work

Elastic Stack Beats
1

Hi,

Configuring filebeat version 8.2.1 autodiscover template with multiple conditions doesn't work:
This works:

            templates:
              - condition.or:
                  - not.equals:
                      kubernetes.namespace: "longhorn-system"

This doesn't:

            templates:
              - condition.or:
                  - not.equals:
                      kubernetes.namespace: "elastic-system"
                  - not.equals:
                      kubernetes.namespace: "longhorn-system"

When adding multiple conditions none of them is respected.
I'm getting crazy over here after spending one full day on this.

Full config:

apiVersion: beat.k8s.elastic.co/v1beta1
kind: Beat
metadata:
  name: filebeat
  namespace: elastic-system
spec:
  type: filebeat
  version: 8.2.1
  elasticsearchRef:
    name: elasticsearch
  kibanaRef:
    name: kibana
  config:
    filebeat:
      autodiscover:
        providers:
          - type: kubernetes
            node: ${NODE_NAME}
            templates:
              - condition.or:
                  # - not.equals:
                  #     kubernetes.namespace: "elastic-system"
                  - not.equals:
                      kubernetes.namespace: "longhorn-system"
                config:
                  - type: container
                    paths:
                      - /var/log/containers/*-${data.kubernetes.container.id}.log
...
2

Hi,

does it make sense?

namespace != elastic-system or namespace != longhorn-system = always true?

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.