I'm having trouble configuring filebeat on Kubernetes.
Let's say you want filebeat to get the containers logs from Kubernetes, but you would like to exclude some files (for example because you don't want to get logs from filebeat, which is also running as a pod on Kubernetes).
I thought this prospector config would be right, but no luck so far:
- type: docker containers: ids: - "*" path: "/var/log/containers" exclude_files: - "/var/log/containers/filebeat*.log" - "/var/log/containers/logstash*.log" processors: - add_kubernetes_metadata: in_cluster: true default_matchers.enabled: false matchers: - logs_path: logs_path: /var/log/containers/
Am I doing something wrong, or is it just not possible at the moment ?
This work seems to been made possible thanks to this PR : https://github.com/elastic/beats/pull/4981 .
Using filebeat:6.1.3, btw.