Filebeat autodiscover kubernetes and set indexname per namespace

Elastic Stack Beats
1

hi i want to use autodiscover for log shiping to elastic and i neesd add indexname per namespace
but i get errore whene deploy manifest

2022-07-23T07:15:19.798Z        ERROR   instance/beat.go:916    Exiting: error in autodiscover provider settings: error setting up kubernetes autodiscover provider: missing or invalid condition
Exiting: error in autodiscover provider settings: error setting up kubernetes autodiscover provider: missing or invalid condition

anyone can help me ?
this is my config


apiVersion: v1
kind: ConfigMap
metadata:
  name: filebeat-config
  namespace: kube-logging
  labels:
    k8s-app: filebeat
data:
  filebeat.yml: |-
    filebeat.autodiscover:
      providers:
        - type: kubernetes
          host: ${HOSTNAME}
          hints.enabled: true
          hints.default_config.enabled: false
          labels.dedot: true
          annotations.dedot: true
          templates:
            - condition:
                  - equals:
                      kubernetes.namespace: kube-logging
              config:
                - type: container
                  paths:
                    - /var/log/containers/*-${data.kubernetes.container.id}.log
                     #  exclude_lines: ["^\\s+[\\-`('.|_]"]  # drop asciiart lines
                  processors:
                    - decode_json_fields:
                        fields: ["message"]
                        target: "json_message"
                        process_array: true
                    - add_fields:
                        ownerlog: elastic
            - condition:
                 - equals:
                     kubernetes.namespace: development
              config:
                 - type: container
                   paths:
                    - /var/log/containers/development*-${data.kubernetes.container.id}.log
                   processors:
                    - add_fields:
                       ownerlog: development
    processors:
      - add_host_metadata:
      - add_kubernetes_metadata:
          namespace: 'kube-system'
          in_cluster: true
          default_matchers.enabled: false
          default_indexers.enabled: false
          host: ${NODE_NAME}
          matchers:
            - logs_path:
                logs_path: '/var/log/containers'
                resource_type: 'pod'
    output.elasticsearch:
      hosts: ['${ELASTICSEARCH_HOST:elasticsearch.kube-logging.svc.cluster.local}:${ELASTICSEARCH_PORT:9200}']
      pipelines:
      - pipeline: "development"
        when.equals:
          #kubernetes.namespace: development
          fields.ownerlog: development
      indices:
      - index: "sre-development-%{[fields.logtype]}-%{+xxxx.ww}"
        when.equals:
          fields.ownerlog: development
          #kubernetes.namespace: development
2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.