hi i want to use autodiscover for log shiping to elastic and i neesd add indexname per namespace
but i get errore whene deploy manifest
2022-07-23T07:15:19.798Z ERROR instance/beat.go:916 Exiting: error in autodiscover provider settings: error setting up kubernetes autodiscover provider: missing or invalid condition
Exiting: error in autodiscover provider settings: error setting up kubernetes autodiscover provider: missing or invalid condition
anyone can help me ?
this is my config
apiVersion: v1
kind: ConfigMap
metadata:
name: filebeat-config
namespace: kube-logging
labels:
k8s-app: filebeat
data:
filebeat.yml: |-
filebeat.autodiscover:
providers:
- type: kubernetes
host: ${HOSTNAME}
hints.enabled: true
hints.default_config.enabled: false
labels.dedot: true
annotations.dedot: true
templates:
- condition:
- equals:
kubernetes.namespace: kube-logging
config:
- type: container
paths:
- /var/log/containers/*-${data.kubernetes.container.id}.log
# exclude_lines: ["^\\s+[\\-`('.|_]"] # drop asciiart lines
processors:
- decode_json_fields:
fields: ["message"]
target: "json_message"
process_array: true
- add_fields:
ownerlog: elastic
- condition:
- equals:
kubernetes.namespace: development
config:
- type: container
paths:
- /var/log/containers/development*-${data.kubernetes.container.id}.log
processors:
- add_fields:
ownerlog: development
processors:
- add_host_metadata:
- add_kubernetes_metadata:
namespace: 'kube-system'
in_cluster: true
default_matchers.enabled: false
default_indexers.enabled: false
host: ${NODE_NAME}
matchers:
- logs_path:
logs_path: '/var/log/containers'
resource_type: 'pod'
output.elasticsearch:
hosts: ['${ELASTICSEARCH_HOST:elasticsearch.kube-logging.svc.cluster.local}:${ELASTICSEARCH_PORT:9200}']
pipelines:
- pipeline: "development"
when.equals:
#kubernetes.namespace: development
fields.ownerlog: development
indices:
- index: "sre-development-%{[fields.logtype]}-%{+xxxx.ww}"
when.equals:
fields.ownerlog: development
#kubernetes.namespace: development